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Limited Hardware Warranty 

Applied Microsystems Corporation warrants that all Applied Microsystems 
manufactured products are free from defects in materials and workmanship from date 
of shipment for a period of one (1) year, with the exception of mechanical parts (such 
as probe tips, cables, pin adapters, test clips, leadless chip sockets, and pin grid array 
adapters), which are warranted for a period of 90 days. If any such product proves 
defective during the warranty period, Applied Microsystems Corporation, at its 
option, will either repair or replace the defective product This warranty applies to 
the original owner only and cannot be transferred. 

To obtain warranty service, the customer must notify Applied Microsystems 
Corporation of any defect prior to the warranty expiration and make arrangements 
for repair and prepaid shipment to Applied Microsystems Corporation. Applied 
Microsystems Corporation will prepay the return shipping to US locations. For 
international shipments, the customer is responsible for all shipping charges, duties, 
and taxes. Prior to returning any unit to Applied Microsystems Corporation for 
warranty repair, a return authorization number must be obtained from Applied 
Microsystems Corporation's Customer Service Department (see Service section on 
the previous page). 

This warranty shall not apply to any defect, failure, or damage caused by improper 
use, improper maintenance, unauthorized repair, modification, or integration of the 
product 

Hardware Extended Warranty 

Applied Microsystems Corporation's optional extended warranty is available for all 
hardware products for an additional charge at the time of the original purchase. The 
extended warranty may be purchased to extend the warranty period on mechanical 
parts normally restricted to 90 days to a total of one (1) or two (2) years and to extend 
the warranty on electrical parts and all other mechanical parts to two (2) years. 
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Hardware Service Agreements 

Service agreements are available for purchase at any time for qualified Applied 
Microsystems Corporation manufactured products. The service agreement covers the 
repair of electrical and mechanical parts for defects in materials and workmanship. 
For information, contact your local sales office. 

Warning 

This equipment generates, uses, and can radiate radio frequency energy and, if not 
installed and used in accordance with the instruction manual, may cause interference 
to radio communications. It is temporarily permitted by regulation and has not been 
tested for compliance with the limits of Class A computing devices pursuant to 
Subpart J of Part 156 of FCC Rules, which are designed to provide reasonable 
protection against such interference. Operation of this equipment in a residential 
area is likely to cause interference. It is up to the user, at his own expense, to take 
whatever measures may be required to correct the interference. 



iv 



PREFACE 1 

Table of Contents 

Preface 



PREFACE 1-i 

Unpacking and Inspection 1-i 

Service 1-ii 

Limited Hardware Warranty 1-iii 

Hardware Extended Warranty 1-iii 

Hardware Service Agreements 1-iv 

Warning 1-iv 



PREFACE 



Unpacking and Inspection 

Your ES 1800 emulator has been inspected and tested for electrical and mechanical 
defects before shipping, then configured for the line voltage requested. Although the 
emulator was carefully packed, check it for possible transit damage and verify that 
the following components are present 

If you find any damage, file a claim with the carrier and notify Applied Microsystems 
Corporation. In the United States and Canada, call 800-426-3925 and ask for 
Customer Service. Outside the U.S. and Canada, please contact your local sales office 
or representative. 

Standard Equipment 

1. Emulator chassis with power cord, includes two boards: main control board 
and trace and break board 

2. Processor specific equipment: emulation board and either a 68000, 68010 or 
68020 pod. 

3. ES 1800 Emulator User's Manual for 68000 Series Microprocessors 
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Optional Equipment 

1 . Overlay memory board (choice of 128K, 256K, 5 12K, 1M or 2M) 

2. Symbolic debug 

3. Dynamic trace board 

4. Time stamp module and manual addendum 

5. Logic state analyzer pod 

6. Null target 

7. SCSI high speed communications: includes SCSI board, terminator resistor 
network, SCSI cable and manual. PC version includes Emulex IB02 card. Sun 
version includes ES Driver control software. 

8. ES Driver emulator control software, ES Driver User's Manual and cable 

9. Software debugger with associated manuals and cables 

10. Compiler, assembler and associated manuals 

1 1 . Additional processor support: additional control board and pod 

12. Carrying case 

Service 

If the ES 1800 unit needs to be returned for repairs, please follow these instructions. 

In the United States and Canada, 

1. Call 800-426-3925 and ask for Customer Service. They will give you a return 
authorization number and shipping information. 

Outside the U.S. and Canada, 

1. Please contact your local sales office or representative for repair procedures. 

After the expiration of the warranty period, service and repairs are billed at standard 
hourly rates, plus shipping to and from your premises. 
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INTRODUCTION 



The ES 1800 emulation system allows you to analyze and control a target 
environment, consisting of hardware or software, in real time. To use the ES 1800 
with your target hardware, simply remove the target system's microprocessor and 
plug in the ES 1800 emulator. Your system uses the emulator in place of the 
microprocessor and behaves as if the target microprocessor is present The ES 1800 
emulator continues to run until you manually stop it or it encounters a user defined 
stop condition. This predefined condition can be in the form of single-step operation 
statements or more complex event monitor (WHEN/THEN) statements. 

During the debugging or integration process you can read and write to the 
microprocessor registers or memory locations and execute programs contained in the 
target system memory. The ES 1800 emulator also allows you to debug software 
without being physically connected to the target system. In this configuration, the 
ES 1800 emulator uses a null target combined with overlay memory capabilities. 

Information in this manual applies to Motorola 68000/68008/68010/68020 
microprocessors only. For more complete information on your particular chip, refer 
to the reference manuals: 16 Bit Microprocessors Users Manual (for the 68000/08/10 
microprocessors) or the MC68020 32 Bit Microprocessors Users Manual (for the 
68020 microprocessor) published by Motorola Corporation. 
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How to Use This Manual 

This manual is your guide to using the Applied Microsystems Corporation's ES 1800 
emulator for Motorola 68000/08/10/20 microprocessors. For your first time using the 
ES 1800, read through the Introduction and Getting Started sections and refer to the 
Hardware section to make sure your hardware is set up correctly. 

Once you are familiar with the ES 1800, Chapters 4, 5, 6, 7, 8 and 9 provide 
information on the ES language, system commands, target commands and ES 1800 
options. The comprehensive Index and Appendix A: "ES Language Mnemonics" are 
useful for finding specific information in the manual. 

The manual is organized as follows: 

Section 1: Introduction introduces Applied Microsystems Corporation's ES 1800 
emulator for the 68000/08/10/20 microprocessors. It explains emulation, set-up, and 
configuration requirements, and provides an overview of the features of the ES 1800. 

Section 2: Getting Started provides a checklist for setting up your emulator and 
target system, starting and testing the ES 1800 emulator, and storing customized 
system variables in EEPROM. 

Section 3: Hardware contains all the information on the ES 1800 emulator, the 
control boards, the rear panel, the pod, and the serial ports, as well as information on 
maintenance and troubleshooting. 

Section 4: ES Language explains the structure of the language that controls the 
ES 1800 emulator, with clear explanations of the help menus, prompts, special modes 
and characters, and language-related error messages. 

Section 5: System Commands provides a reference to commands that control the 
ES 1800 emulator system. It is divided into sections on setup, serial 
communications, download operations, registers, trace memory, macros, and 
symbols. 

Section 6: Target Commands is a reference to commands that directly control the 
target system. It is divided into sections on running the target program, memory i 
commands, the line assembler, the memory disassembler, memory mode, and 
diagnostics. 
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Section 7: 68000/08/10 Event Monitor System explains the powerful breakpoint 
and control system, including the structure of the system, breaking emulation, 
counting events, using special interrupts, and tracing events. Complete information 
on the Time Stamp Module is also included in this chapter. (This chapter pertains to 
the 68000, 68008, and 68010 microprocessors.) 

Section 8: 68020 Event Monitor System explains the powerful breakpoint and 
control system, including the structure of the system, breaking emulation, counting 
events, using special interrupts, and tracing events. The different trace modes that 
pertain only to the 68020 microprocessor are covered, as well as setup shortcuts. 

Section 9: ES 1800 Options includes information on using optional hardware and 
software products to increase your debugging capability with your ES 1800 emulator. 

Appendix A is a quick reference to ES Language mnemonics, which can be used to 
guide you to the appropriate page in the manual. 

Appendix B provides explanations of ES Lanquage and target hardware error 
messages and serial data formats. 

Appendix C describes the object module formats available for uploading and 
downloading files. 

Appendix D lists the available application notes. 
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System Setup 

The ES 1800 can debug and integrate software and hardware. Setups for each system 
may be different In every combination, there is a 'target' system, which can be 
hardware, software alone (if you are using the emulator's overlay memory to debug 
software), or a combination of the two. The target system is the environment you 
intend to emulate. 



The ES 1800 emulator consists of a chassis assembly which houses the control boards 
and an ES 1800 pod which houses the emulating microprocessor. The emulator can 
be controlled with a terminal, which can be your development system CRT or 
another device set to function in terminal mode, or controlled via a host computer 
system. 



You can enhance this basic system by adding one or more of several hardware and 
software packages. The hardware options include: 



Overlay Memory 



SCSI Communications 



Time Stamp Module 



Logic State Analyzer 



Overlay memory can be added with an overlay memory 
board. Overlay memory can be mapped anywhere in 
the address space of the target system. The overlay 
memory board provides additional capabilities, 
including the ability to debug software with or without 
a target system. 

SCSI communications provides faster download 
speeds. Data can be transferred at rates of up to 
1.5MB/second rather than the RS-232 rates of 
19.2Kbaud. 

The Time Stamp module adds performance analysis 
capabilities. You can measure elapsed time your 
program spends in a module, outside of a module or 
between modules for up to 4 modules at once. This can 
provide a picture of where your program spends the 
most time, so you can choose the areas which benefit 
most from optimization. 

The optional logic state analyzer (LSA) pod provides 
16 additional input lines, giving access to signals other 
than the normal address, data, and control signals of the 
microprocessor. 



The emulator can be used in a variety of hardware/software debugging environments. 
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The stand alone environment (refer to diagram in 
Figure 1-1) consists of the ES 1800 and a dumb 
terminal or equivalent connected to the ES 1800 
terminal port This configuration can debug target 
systems with software already installed or short, 
hand-entered routines. The stand-alone configuration 
is common in manufacturing test and service 
facilities. 

Figure 1-1. Stand Alone Environment 
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Connected to Host Computer 



The ES 1800 can also use data stored in a host 
development system by setting up a hosted 
environment. The emulator is still under the direct 
control of the terminal, but you can load data from 
the host computer's data files. 



Figure 1-2. ES 1800 Connected to a Host Computer 
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By attaching a printer, data and code from the target 
system can be printed out in assembly language. 
You can also print all emulator commands and their 
results. The ES 1800 system has two serial ports and 
uses standard RS232C serial port protocol. Each port 
can be independently configured for baud rate, data 
length, and number of stop bits. 

Controlled by Host Computer The ES 1800 can also be totally controlled by a host 

system. This hosted software environment requires 
special host resident software: either the ES Driver 
emulator control software, or a high level language 
debugger. ES Driver control software and high level 
language debuggers are available from Applied 
Microsystems for most languages and host systems. 

Figure 1-3. ES 1800 Controlled from Host Computer 
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System Operation 

Overview 

The ES 1800 has two basic operational modes: run mode and pause mode. Pause 
mode is used to set up the system configuration and to display information after 
leaving emulation. System setup is accomplished from two menus. The first menu 
contains all external communication variables; the second contains the control 
switches for emulation and serial port data output. Both setups can be saved to 
EEPROM and automatically loaded at power-up. 

Run mode or emulation means that the microprocessor in the ES 1800 emulator pod 
is running a program in the target system, allowing you to see what is happening 
within the target system. Emulation stops when (1) you stop it, (2) user-defined 
breakpoints are enabled and occur, (3) you reset the system, or (4) errors occur in the 
target system. 

When you manually stop emulation or a breakpoint is reached, you enter pause 
mode. All registers and addresses are then available for examination, along with a 
trace history of performance of the microprocessor. A command language allows 
you to enter emulation in the desired state and leave emulation when a specific 
combination of events is detected in the target. 

ES Language 

The ES 1800 uses its own command language. To take advantage of the sophisticated 
operations of the ES 1800, you must understand the general concepts of this 
language. The ES 1800 operates in response to command statements composed of 
command mnemonics and, for some commands, arguments. An argument to a 
command is an additional value entered as part of the command sequence, such as an 
address range or base value. Arguments can consist of single values, expressions, or 
lists. 

The command statements form a control language, similar to higher-level computer 
languages. Like a computer language, the operators and values can be combined to 
form complex expressions. Statements have a maximum length of 76 characters and 
can be extended by the use of macros. 
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The ES Language contains registers, counters, and conditional statements allowing 
the user full control over the operation of the target system. To complete the 
language, a full set of error messages is provided for (1) target hardware, (2) 
emulator hardware, (3) target software, and (4) ES Command Language syntax. 

Real time 

Since the pod processor is identical to your target microprocessor, the target system 
runs in real time. No wait states are inserted by the emulator during run mode. 
Additionally, the ES 1800's internal clock provides a completely self-contained 
microprocessing environment that allows you to execute your software without 
connecting the ES 1800 to your target system, using the null target. 

Trace Memory 

Trace memory functions as a history of your target system program's execution. This 
memory can record 2046 bus cycles and display these in machine or assembly 
language. All address lines, data lines, processor status lines, and 16 bits of external 
logic input are traced. If something unexpected happens during program execution, 
trace memory can be reviewed to determine the sequence of commands executed 
prior to the unexpected event When used in conjunction with the trace disassembler, 
hardware and software problems can be quickly tracked down. 

Trace memory can be selectively switched on by the Event Monitor to trace events 
only when certain conditions are met. Program execution can be stopped at any 
point, either manually or using the Event Monitor System. The address, data, and 
control signals of the most recently traced cycles can then be critically reviewed. 

If you have the Dynamic Trace feature, you can view trace without stopping 
emulation. Without the Dynamic Trace feature, you can stop the program to read 
trace with either an asynchronous stop or by using the Event Monitor System to stop 
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at the exact program state you are interested in. 
Overlay Memory 

Overlay memory is emulator working memory, which can be used in a variety of 
ways. When debugging software without target hardware, the target program is 
loaded into overlay memory where it can be edited and positioned in the target 
system address space as desired. The program executes in real time as if it resided 
totally in the target system. Overlay memory is also useful when target hardware is 
connected, for loading portions of software, making patches, and checking programs 
not yet committed to PROM. 

The overlay memory is RAM with appropriate address and control logic, ranging in 
size from 32K to 2M bytes and locatable in 2K-byte segments throughout the system. 
Each segment can be assigned one of four attributes: target, read/write, read-only, or 
illegal. Unmapped memory is assigned the target attribute by default. Overlay 
memory mapped as read-only can always be modified by the ES 1800. However, if a 
target program tries to write to read-only overlay, emulation stops and an error 
message is displayed. 

When a segment of memory is mapped, program accesses to that memory range are 
directed to the overlay instead of the target. Overlay memory accesses occur in real 
time, with no wait states added by the ES 1800. 

Event Monitor System 

The ES 1800's Event Monitor System provides unprecedented breakpoint and system 
control, enabling the user to isolate and break on any predefined series of events and 
then perform actions defined by WHEN/THEN conditional statements. The user 
controls and monitors the target with the Event Monitor System by defining 
statements that specify single or multiple events through logical combinations of 
address, data, status, pass counter, and optional logic field states. When those events 
are encountered in the target system program, the ES 1800 can break emulation, trace 
specific sequences, count events, and trigger outputs, all independently, allowing the 
user to analyze the cause-effect relationship established by the event/action 
sequences defined. 

The Event Monitor System uses four groups, each containing eight registers, to let 
the user monitor a complex series of events through multiple actions and 
combinations of comparator registers. The system uses one group at a time, with each 
WHEN/THEN statement active in a specific group. WHEN/THEN statements can 
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switch to different groups and access conditional statements and registers for that 
group. The user can control the tracing of 2046 machine cycles, selecting the desired 
instructions to be recorded in the trace memory. 

Symbolic Debugger (Optional) 

The symbolic debug option allows you to assign frequently used values to symbol 
names that are easily remembered. Features include: 

1 . Reference to an address by a name instead of a value 

2. Display of all symbols and sections with their values 

3. Editing (entry and deletion) of symbols and their values 

4. Automatic display of symbolic addresses during disassembly 

5. Section (module) symbols that can be used as range arguments and for section 
offsets in trace disassembly 

6. Upload and download of symbol and section definitions using standard serial 
formats 

Because symbols are a powerful extension of the ES 1800, they are frequently used 
in examples throughout Section 5, System Commands. Please note that if you have 
not yet purchased the symbolic debug option, you may need to modify these 
examples. 

Time Stamp Module (Optional) 

An optional feature, the Time Stamp Module, adds performance analysis capabilities 
to the ES 1800. Since the timestamp feature is already built into the the ES 1800 for 
the 68020, the Time Stamp Module is only available for 68000/08/10 processors. 

This module allows you to measure elapsed time your program spends in a module, 
outside of a module or between modules for up to 4 modules at once. This can 
provide a picture of where your program spends the most time, so you can choose the 
areas which benefit most from optimization. 

It also allows you to count the number of times a module or address range is accessed 
in order to troubleshoot iteration problems and help with optimization decisions. 

The time from a hardware interrupt to a software service routine can also be 
measured. A direct electrical connection between the interrupt line on your target 
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processor and the Time Stamp Module lets you avoid delay in processing interrupts. 
Logic State Analyzer LSA (Optional) 

LSA inputs can qualify event specifications in the Event Monitor System. In the 
simplest form, specific bit patterns at the LSA inputs can cause a breakpoint The 
LSA comparator can detect complex event specifications as well. The LSA provides 
an additional means of monitoring information from other parts of the target system, 
beyond the normal recording of trace data performed by the ES 1800. This is useful 
when monitoring (1) buffers suspected of failure, (2) decode logic, (3) memory 
management circuit translations, and (4) asynchronous external events. 

Diagnostic Functions 

Diagnostics available in the ES 1800 emulator include both RAM/ROM tests and 
scope loops. RAM test routines verify that RAM is operating properly. They can be 
run on the target RAM or emulator overlay memory and may be executed in either 
byte or word mode. ROM tests include a built-in CRC algorithm. 

High speed memory scope loops for troubleshooting with an oscilloscope are built 
into the ES 1800 emulator firmware. They can be used for locating stuck address 
data, status or control lines, and generating signatures using signature analysis 
equipment. 

The firmware that generates the scope loops is optimized for maximum speed of 
execution. This short cycle time allows the hardware engineer to review the timing 
of pertinent signals in the target system without using a storage oscilloscope. The 
scope loops can be executed in either byte, word, or long word mode. 

Software Options 

For information on using available software options, see Section 9, "ES 1800 
Options". 
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GETTING STARTED 



Introduction 

This section provides a checklist for setting up your ES 1800 emulator and target 
system, starting and testing the ES 1800, and storing customized system variables in 
EEPROM. 

Emulator Set-up 

1. Refer to page 3-1 and verify that proper grounding and power requirements 
have been met. 

2. Remove the front cover of the ES 1800 by turning the thumbscrews 
counterclockwise. The pod and LS A pod may need to be unplugged in order to 
do this. 

3. Verify that the main control board and the memory control board are in the top 
two slots of the ES 1800 chassis. 

4. Verify that the trace/break board is in the third bus slot of the ES 1800 chassis. 

5. If you are using overlay memory, verify that the overlay memory master, 
and/or master and slave boards, if needed, are inserted. 

6. Verify that the correct ES 1800 board for your target microprocessor is in the 
bottom slot (See page 3-3 for board positions.) 

7. Verify that all boards are firmly seated in their motherboard connectors. 

8. Set the thumbwheel switch on the main control board for your particular 
system variables (see page 3-4). 
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System default variables in switch position 0 are: 



- 9600 baud 


- 8-bit word length 


- One stop bit 


- No parity 


- Full duplex 


- No echo 


- Terminal control 


- XON and XOFF are recognized 


- 8th data bit 


set to 0 or a space 



9. Verify that the three-position toggle switch on the memory control board is in 
the center position. (See page 3-3). 

NOTE: If you are using an early ES 1800 model, the above comment may not 
apply. Follow the instructions provided at the time of purchase. 

10. Replace front panel and attach the correct pod assembly (see page 3-6). A pod 
assembly must be connected to the ES 1800 even if you are not using target 
hardware. 

NOTE: Use caution when connecting your 68020 pod to the base unit. The 
female connectors on the cable are marked Jl and J2, as are the connectors on 
the base unit. Be sure to match the connectors to the proper socket and 
properly orient the pins to the socket. J2 should be the top connector (see 
Figure 1 below). Failure to correctly connect the pod may result in a burned- 
out unit. 

Figure 2-1. Proper Base Unit/Pod Connector Orientation 
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1 1 . OPTIONAL: Connect Logic State Analyzer pod (see page 3-12). 

12. Verify that the RS232C cable connections are correct for the system 
configuration you plan to use (see page 3-13, Pin Configurations). 

13. Verify that the RS232C baud rates and data requirements are set the same on 
both the ES 1800 and the terminal (see page 3-4). 

NOTE: the 68020 microprocessor requires different pod connections 
depending on the trace memory mode you are intending to use (refer to page 
3-8). 

14. If using communications without a modem, you may need a null modem cable. 
If you purchase a null modem cable, it is likely to have the following 
configuration. 

Figure 2-2. Null Modem Cable 
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Check the specifications in your terminal manual before reversing the pins. 

NOTE: pins 6, 8, and 20 are not used and are unaffected by the cable 
configuration. 

15. If you plan to use dynamic RAM, read the pages on the ON-OFF switches CAS 
and TAD. CAS controls whether the address strobe is active in pause mode 
(page 5-14), and TAD controls whether the emulator address bus is tri-stated 
during pause mode (page 5-24). 
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Target System Set-up 

1. Check that the target has a 48 pin package dual in-line socket for the 68008 
chip, a 64 pin package for the 68000/68010 chips, and a 114 pin grid array for 
the 68020 chip. 

2. Check that a good ground exists at the microprocessor socket using an 
ohmmeter. 

3. Validate the power supply at the microprocessor socket It should read 5V ± 
10%. 

4. Check for a valid clock signal at the target microprocessor socket 

5. Turn off target system power and ES 1800 power. 

6. Plug in the probe tip (see page 3-6). 
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Power-On Sequence 

Target System Present 

1. Turn on the target system. 

2. Turn on the ES 1 800 emulator. 

3. Reset the target system (see page 6-14). 

No Target System 

1. Verify that the pod is connected to the emulator (see page 3-6). 

2. Remove the conductive rubber probe tip protection and install Null Target 
Software Simulation Tool (see page 3-10). 

3. Power-up the emulator. 

4. The log-in banner is displayed (see page 4-23). 

When you power-up the ES 1800, all registers, maps, event clauses, and system 
variables are either cleared or set to default values. Examine the SET and ON menus 
(see pages 5-3 and 5-10) and configure the system as desired. Your special setup can 
then be stored in EEPROM (see page 5-26). By setting the rotary switch on the 
controller board to the proper position, your special setup can be autoloaded on 
power-up. 

The ES 1800 emulator system is now running and ready to accept ES Language 
commands. 
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Test Run of System 

Use this test guide after the system configuration is correct and the ES prompt is 
displayed ( >). 

A system test run consists of the following 9 steps: 

1. Initialize ES 1800 emulator 

2. Map overlay memory 

3. Test RAM 

4. Enter a program 

5. Verify a program 

6. Run the emulator 

7. Stop the program 

8. Display the trace buffer 

9. Set a breakpoint 

This test requires that an optional overlay memory board is installed. This 
demonstration does not need a target system. 

If you encounter difficulty with the ES 1800 hardware, call Applied Microsystems 
Corporation Customer Service at 800-426-3925 for assistance. 

1. Initialize The Emulator 

Enter the following to initialize the emulator: 



>SET 1,0;SAV;SET 1,1;SAV;SET 1,0 
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2. Map Ram Memory 

Map all of the overlay memory available to the emulator. 

>MAP 0 TO XXXX 



(Where XXXX is the ending address (in hex) of the amount of overlay memory 
installed.) The following table provides a quick reference for hex values 
corresponding to overlay memory sizes. 



Hex value 


Overlay memory 


7FFF 


32K 


OFFFF 


64K 


1FFFF 


128K 


3FFFF 


256K 


7FFFF 


512K 



For example, to map 64K, enter: 



>MAP 0 to OFFFF 

For more information, refer to page 5-55. 
3. Test RAM 

Test all overlay memory installed by entering: 

>SF 1, 0 TO XXXX 

(Where XXXX is the ending address (in hex) of the amount of overlay memory 
installed.) If there is a failure, repeat mapping and testing. 

If RAM test continues to fail, reseat all PAL and RAM chips on the overlay memory. 
For more information, refer to Diagnostic Functions, page 6-49. 
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4. Enter Program 

Enter a short program by invoking the line assembler and entering 68000 op codes 
(see page 6-34). 



>ASM 400 




**** 680XX 


LINE ASSEMBLER **** 


000400>NOP 




000402>/ 




000404>/ 




000406>/ 




000408>/ 




00040A>BRA 


$400 


00040OX 





NOP is a null operation. Each time you type the slash ( / ), you repeat the previous 
command. You have entered the equivalent of five lines of NOPs. The X at the end 
exits the assembler. 



5. Verify The Program 

Single step through the program, to verify that it works, by entering: 



>PC = 


400 


>STP; 


DT 


>/ 




>/ 




>/ 




>/ 




>/ 





The disassembled trace should show that NOPs were executed and that the branch 
was taken correctly. 

For more information on the STP command, refer to page 6-8. 
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6. Run The Emulator 
Enter RUN. 

>RUN 
R> 

The R> prompt should be displayed with no error messages. This indicates the 
emulator is running in real time, executing the program. 

7. Stop The Program 

Enter STP to stop. 

R>STP 

The emulator should stop running and display the PC register value. 

8. Display The Trace Buffer 

Enter DRT to display the execution history of the program. 

>DRT 

The display should show sequence numbers between 0 and 20, and address values 
between 400 and 40E. Then enter DTB. 

>DTB 

The display should show a disassembled trace of the program with NOPs and BRA 
$000400. 
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9. Set A Breakpoint 

Set a breakpoint to verify that the Event Monitor System will halt execution when a 
defined condition is met. In this case, the emulator executes 100 (hex) bus cycles, 
then breaks. 

Enter: 



>WHEN DC1 THEN CNT 

>WHEN CL THEN BRK 

>DC1=0XXXX 

>CL=100 

>RBK 

R> 



This causes the counter to be incremented each time data comparator 1 sees a data 
bus value between 00000 and 0FFFF. When the count limit of 100 is reached, 
emulation will break. 

If a break does not occur: 

1. Enter STP. 

2. Set PC to 400. 

3. Enter DES 1 and verify that you have entered the WHEN/THEN statement and 
comparator values as shown above. 

4. Type RBK again. 

If no break occurs, call Applied Microsystems Applications Engineering at 
800-426-3925 for assistance. 
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Emulator Chassis 

The ES 1800 emulator chassis is the metal enclosure housing the control boards for 
your target system. This rack mountable chassis houses up to six boards as shown in 
the figure on page 3-3. 

The ES 1800 emulator power supply is also in this chassis. A power switch on the 
rear panel is the only external panel control. 

WARNING 

A cooling fan and vent for the ES 1800 emulator are located on the left side panel 
of the chassis. The warm air exhaust vent is in the right side panel. Blocking 
either of these panels may cause the ES 1800 emulator to overheat. 

System Grounds 

The ES 1800 emulator has three grounding systems: 

1. A CHASSIS ground from the metallic enclosure of the unit to the power filter. 

2. An AC PROTECTIVE ground from the green ground wire of the AC power 
cord and the chassis ground at the power filter. 

3. A SIGNAL ground connected by a jumper at the power supply terminal strip 
to the chassis ground. The ES 1800 emulator has a three-wire power cord with 
a three-terminal polarized plug. The ground terminal of the plug is connected 
internally to the metal chassis parts of the ES 1800 emulator. 

WARNING 

Failure to ground the system properly may create a shock hazard. 
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Emulator Control Boards 

Removing the front panel of the ES 1800 chassis exposes the chassis card cage as 
shown in Figure 3-1. Open this panel by turning the two knobs in the upper corners 
of the front panel counterclockwise. The list below starts with the top board. 



SCSI Board (Optional) 



MCB Controller Board 



Trace/Break Board 



RAM Overlay Board(s) 
(Optional) 



Emulation Board 



The SCSI board is required in order to use SCSI 
communications between the ES 1800 and host computer. 
If present, it should be in the top slot in the chassis. The 
SCSI port is discussed in detail in the SCSI Addendum for 
ES 1800 Emulators. 

The MCB controller board holds the controlling 6809 
CPU for the ES 1800, the EEPROM, two serial ports, 
RAM, the memory management logic and optional 
symbolic memory. 

The 16-position thumbwheel switch on this board 
determines the system variables and serial line baud rates 
for autoloading on power-up. Refer to page 3-4 for each 
switch position setup. Switch position 0 autoloads 
default system variables. 

The three-position toggle switch must be in the center 
position. If the toggle switch is in either of the other two 
positions, the ES 1800 will not work properly. 

If there is no SCSI board, this board should be in the top 
slot in the chassis. 

The trace/break board holds trace memory, the Event 
Monitor System, and the logic state analyzer (LSA) 
interface. 



The RAM overlay board is optional and can hold 128K, 
256K, 512K, 1M or 2M of memory. 2M of memory 
requires a slave board. 

The emulation board depends on the target 
microprocessor you are using. It contains the target 
processor specific logic. 
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Figure 3-1. Control Boards 
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Emulation Board 




Thumbwheel Switch Settings 




posmoN 


PARAMETERS 


BAUD RATE 


0 


Factory Default* 


9,600 


i 


User "0" defined 


User defined 






Terminal control 


2 


User "1" defined 


User defined 






Terminal control 


3 


User "0" defined 


User defined 






Computer control 


4 


User "1" defined 


User defined 






Computer control 


5 


Factory Default* 


110 


6 


Factory Default* 


300 


7 


Factory Default* 


1,200 


8 


Factory Default* 


2,400 


9 


Factory Default* 


4,800 


A 


Factory Default* 


7,200 


B 


Factory Default* 


19,200 


C,D,E,F 


Reserved for factory use 




^Factory Default Parameters 




- 8 -bit word length 


- one stop bit 




- no parity 


- full duplex 




- Terminal control 


- XON and XOFF are recognized 


- no echo 


- baud rate the same for both terminals 




- 8th data bit set to 0 or a space 



Note: Before using switch positions 1-4, (any position other than factory default), be 
sure EEPROM is compatible with the current version and microprocessor. 
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Emulator Chassis Rear Panel 

The rear panel of the ES 1800 emulator mainframe is shown in Figure 3-2. 



Serial Ports 



Trigger Output 



Power Switch 



Line Fuse 



The two serial ports are RS 232C ports labeled TERMINAL and 
COMPUTER. Serial ports are discussed in detail on page 3-13. 

The ES 1800 emulator provides a TTL trigger strobe output 
controlled by the Event Monitor System. The trigger output is 
available at a BNC connector on the rear panel of the chassis and 
on a clip lead attached to the optional Logic State Analyzer (LSA) 
pod. Refer to Section 7 (68000/08/10) or Section 8 (68020) for 
information on Event Monitor System actions. The trigger can be 
used for such things as: 

1. Synchronizing an oscilloscope to the execution of an I/O 
routine. 

2. Measuring the duration of a routine by asserting the trigger 
for its duration and using a timer-counter. 

3. Cross-coupling two or more ES 1800 emulators so that an 
event in one can control events in the others. 

Before powering up, two items should be checked: 

1 . Proper grounding of power cable (see page 3-1). 

2. Proper power-up sequence of ES 1800 emulator, target 
system, and/or peripheral equipment. (See Power-On 
Sequence, page 2-5.) 

A 3 amp slow-blow fuse for 110V operation or a 1.5 amp slow- 
blow fuse for 220V operations. Remove the fuse by turning the 
fuse holder counterclockwise. 
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Figure 3-2. Rear Panel 

115V/230V SWITCH 




Pod 

The pod is the communications link between the ES 1800 emulator and your target 
system. A 40 inch ribbon cable connects the pod to the ES 1800 emulator board. An 
11 inch ribbon cable ends in a probe tip that is normally inserted into the 
microprocessor socket in your target system. 

The proper pod is determined by the microprocessor being emulated. There are 
different pods for the 68000/08, 68010 and 68020 microprocessors. In addition, there 
is a choice of 68000 and 68020 pods based on the maximum speed. 

There are two styles of pods: one for the 68000 (12.5 MHz), 68008, 68010 and 68020 
(16.67 MHz), and one for the 68000 (16.67 MHz) and the 68020 (25 MHz). Pictures 
of both types of pods are shown below. 
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Figure 3-3. 68010 Pod 

(Typical of 68000 (125 MHz), 68008, 68010, and 68020 (16.67 MHz) pods) 




68020 (25 MHz) Pod 

(Typical of 68000 (16.67 MHz) and 68020 (25 MHz) pods) 
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68020 Pod 

The 68020 microprocessor has four trace memory modes. Each mode requires a 
different ES 1800 emulator/pod configuration. 

The 68020 pod has three ribbon cables that connect to the emulator chassis. All three 
cables are located on the same side of the 68020 pod. The bottom two ribbon cables 
for all four trace modes, always connect to the ES 1800 emulator chassis' emulation 
board. For modes 1, 2, and 3 the top ribbon cable connects to the ES 1800 emulator 
chassis trace and break board. For mode 0 this top cable is not used and in its place 
the LSA pod is connected to the trace and break board. The lower six LSA bits are 
available in mode 3 if you choose to use them. To do so, the LSA pod connects to the 
front panel of the 68020 pod. 

Refer to page 8-14 for more information on 68020 trace modes. 

NOTE: Use caution when connecting your 68020 pod to the base unit. The female 
connectors on the cable are marked Jl and J2, as are the connectors on the base unit. 
Be sure to match the connectors to the proper socket and properly orient the pins to 
the socket. J2 should be the top connector. Failure to correctly connect the pod 
may result in a burned-out unit. See page 2-2 for an illustration. 

Saving Desk Space 

To save limited desk or table space, the 68000 (16.67 MHz) and 68020 (25 MHz) 
pods can be supported from walls, an overhead hook, or other non-horizontal 
surfaces either by velcro tape or by a hanging strap. 
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Velcro Tape 

To support the pod using velcro tape, you must first attach the 5" long bracket to the 
bottom sheet metal of the pod (you may need to bend the bracket slightly). Figure 
3-4 shows bracket placement. When the bracket is in place, simply peel off the 
adhesive backing on the velcro tape strip and firmly press the tape onto the bracket as 
shown in Figure 3-4. You can now attach the 68000 pod to any surface that adheres 
to velcro, such as many types of office partitions. 

Figure 3-4: Velcro Tape Support 



5" long bracket 



velcro tape strip 




bottom view of pod 
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Hanging Strap 

The hanging strap can be threaded through either set of eyelets on the bottom sheet 
metal of the pod. The 5" long bracket is not needed when using the hanging strap. 
Figure 3-5 shows both of these configurations. After threading the strap through the 
eyelet, bend the strap back on itself and fasten it with the enclosed fasteners. Make 
sure the fasteners on both sides are firmly closed before hanging the pod from the 
strap. 

Figure 3-5: Hanging Strap Support 



Null Target Software Simulation Tool 

The Null Target Software Simulation Tool is a device that is about the size and shape 
of a microprocessor chip. It is to be plugged onto the end of your pod probe tip 
adapter. This device allows you to run the ES 1800 emulator without having to be 
connected to a target system. 




' eyelets 
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Time Stamp Module 

An optional feature, the Time Stamp Module, adds performance analysis capabilities 
to the ES 1800. This module allows you to measure elapsed time your program 
spends in a module, outside of a module or between modules for up to 4 modules at 
once. This can provide a picture of where your program spends the most time, so you 
can choose the areas which benefit most from optimization. 

It also allows you to count the number of times a module or address range is accessed 
in order to troubleshoot iteration problems and help with optimization decisions. 

The time from a hardware interrupt to a software service routine can also be 
measured. A direct electrical connection between the interrupt line on your target 
processor and the Time Stamp Module lets you avoid delay in processing interrupts. 

The time stamp module connects directly above the ES 1800 pod to the connector 
labelled LS A Pod. You cannot use both the LS A pod and time stamp module at the 
same time. 

For more details on using your Time Stamp Module, consult Section 7. 
Figure 3-6. Time Stamp Module 
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Logic State Analyzer (LSA) 

An optional feature, the Logic State Analyzer (LSA) pod connects directly above the 
ES 1800 emulator pod. The LSA includes a pod, cables, and probe clips. The LSA 
pod provides 16 input lines and one trigger output line. 

The one trigger output line behaves the same as the BNC signal on the rear panel of 
the ES 1800 emulator and can be used with an oscilloscope. 

Figure 3-7. Logic State Analyzer Pod 




NOTE 

The 25 MHz ES 1800 for the 68020 processor supports the LSA pod with only trace 
mode 0 (see Section 8). The 12 and 16 MHz 68020 LSA pod supports trace modes 0 
and 3. 
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Ports 

There are two serial ports and one optional SCSI port on the ES 1800. For 
information on the SCSI port, see either your SCSI Addendum for ES 1800 Emulators 
or your ES Driver/Sun user's manual. 



Serial Ports 



Both the terminal port (TERMINAL) and the computer port (COMPUTER) end in 
standard RS232C female connectors. Make sure peripheral hardware is connected to 
the correct port. 



Baud Rate 



Port Control 



Upload/Download 



Baud rates and data lengths for each port are independent. 
Refer to the SET command (page 5-3) for available baud 
rates on each port. 

Only one port can be the controlling port. Either port can 
give control to the other port. For complete information, 
see "Serial Communications" in Section 5. 

The ES 1800 accepts commands to begin 
uploading/downloading from either port. However, the 
ES 1800 uploads/downloads hex format data files only 
through the computer port. 



Serial Port Pin Configurations 

The pin configuration of your equipment (terminal, PC or host) may not match that of 
the ES 1800 emulator. It is important to be familiar with the pin configurations of all 
peripheral equipment you intend to use with the ES 1800 emulator. 

The ES 1800 emulator is configured as 'Data Terminal Equipment' (DTE). Before 
powering up, make sure the ES 1800 emulator system and peripheral hardware are 
compatible. Pins 1, 2, 3 and 7 must be connected to peripheral hardware. Pins 4 and 
5 need to be connected if peripherals attached to the ES 1800 emulator use these 
pins. 

Both ES 1800 emulator serial ports use the same pin assignment. All pin assignments 
and voltage levels conform to Electronics Industries Association (EIA) RS232C 
standards. The following chart lists the signals present on each pin. 
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Pin 


Name 


Description 


1 


Protective Ground 


Connected in the ES 1800 emulator to logic 
ground. 


2 


Serial Data Out 


This signal is driven to nominal ± 12 voltage 
levels by an RS232C compatible driver. 


3 


Serial Data In 


Data is accepted on this pin if the voltage 
levels (+ 12V) are as specified by RS232C 
specifications. 


4 


Request to Send (Output) 


This signal is driven to nominal ± 12V levels 
by an RS232C compatible driver. It signals 
other equipment that the ES 1800 emulator is 
ready to accept data at this port. 


5 


Clear to Send (Input) 


An input signal to the ES 1800 emulator 
indicates another piece of equipment in the 
system is ready to accept data. This signal is 
terminated so the ES 1800 emulator operates 
with the signal disconnected. 


6 


Not Used 




7 


Signal Ground 


Connected in the ES 1800 emulator to the 
system logic ground. 


8-25 


Not Used 


These pins are not used by the ES 1800 
emulator but may be required by your 
peripheral hardware. 



Data Requirements 

Stop Bits The ES 1800 emulator software transmits and receives 8 

bit ASCII characters. The number of stop bits is 
determined by SET parameter #11 for the TERMINAL 
port and #21 for the COMPUTER port (see pages 5-6 and 
5-7). 

Parity The ES 1800 emulator sends and checks parity according 

to system SET parameter #12 for the terminal port and 
#22 for the computer port- These two SET parameters 
are listed in the SET MENU (pages 5-6 and 5-8). 

Each character consists of a start bit followed by 8 data 
bits. When no data is being transmitted, the serial data 
out pin (pin #2) will be at the 12 volt level. 
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Hardware Handshake When the ES 1800 emulator is ready to receive data, it 

asserts the Request To Send line (pin #4). When a receive 
buffer is nearly full, the ES 1800 emulator will deassert 
the Request To Send line. 

When the ES 1800 emulator is ready to transmit data, it 
checks the status of the Clear To Send line (pin #5). Data 
will only be transmitted when Clear To Send is high. 

Software Handshake (XON XOFF) The ES 1800 uses normal flow control 

codes to control software handshaking. The default 
values are XON CTRL Q and XOFF CTRL S. These 
values can be changed by the user (see page 5-5). 

The ES 1800 serial 1/0 system contains internal buffers to 
smooth the transmission of data via the serial ports. If an 
input buffer becomes nearly full, the system immediately 
transmits an XOFF character. When the software empties 
the input buffer, an XON character is transmitted. 

Although the user will never overfill the input buffer from 
a controlling terminal, a controlling computer is quite 
capable of doing so. The input buffer for the computer 
port is 64 characters deep. When eight characters have 
been placed in the computer input buffer, the XOFF 
character is transmitted. Allowing two character times 
for skew, the computer must transmit no more than 54 
characters until the next XON from the ES 1800. 

The RTS hardware handshake follows the software 
handshake described above. When an XOFF is 
transmitted, RTS is dropped on that I/O port; when an 
XON is transmitted, RTS is reasserted. 
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Maintenance 

Maintenance of the ES 1800 emulator has been minimized by the extensive use of 
solid-state components throughout the instrument There are three areas where you 
need be concerned: cables, probe tip and cleaning the fan filter. 

Cables 

The interconnect cables are the most vulnerable part of the instrument, due to 
constant flexing during insertion and extraction. First, inspect the cables for any 
obvious damage, such as cuts, breaks, or tears. Even if you have thoroughly 
inspected the cables and cannot find any damage, there may be broken wires within 
the cables (usually located close to the ends). A broken wire within the cable will 
cause the instrument to run erratically or intermittently if the cables are flexed during 
emulation mode. By swapping the cables in question with a known good set of 
cables, you can easily isolate the faulty cable. 

Probe Tip 

The probe tip is the small header that plugs into the target system microprocessor 
socket. The most obvious area to inspect is the adapter, as the pins can be broken 
during insertion or extraction. 

The adapter can be protected by installing a microprocessor socket (male-female) 
onto the adapter. If a pin is then broken on the socket, it is easier to replace because 
of its common usage. 

Cleaning the Fan Filter 

The fan filter should be cleaned regularly. The recommended interval is every 90 
days. If you are working in a dusty environment, you may need to clean the filter 
more frequently. 

1. Unplug the ES 1800. 

WARNING 

Electrical shock and moving fan parts are dangerous. Make sure you 
unplug the unit before proceeding. 

2. Remove the front cover of the ES 1800. (Loosen the two captive fasteners.) 

3. Remove the top cover of the ES 1800. (Unscrew six screws, and lift the cover 
off.) 
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4. Unscrew the two screws at the top of the chassis which hold the fan in place. 
Figure 3-8. ES 1800 Fan Mounting 
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5. Tilt the fan towards the boards in the chassis. 

Figure 3-9. ES 1800 With Fan Tilted for Easy Access to Filter 
FAN FILTER 




6. Remove the fan filter. 

7. Rinse the fan filter in cold water. Thoroughly shake out the excess water. 

8. Replace the fan filter. 

9. Tilt the fan back into the correct position. 

10. Replace the screws connecting the top of the chassis to the fan. 

1 1 . Replace the top and front covers. 
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Parts 

The following parts are available for you to order: 



48 pin adapter (68008 chip) 




64 pin adapter (68000/68010 


chips) 


114 pin grid adapter (68020 


chip) 


Short cable set 




Long cable set 




Troubleshooting 



Check that the interconnect cables are installed properly in a compatible target 
system, with power applied to both the target system and the ES 1800 emulator 
before starting troubleshooting procedures. 



The most common problems encountered are listed below. We recommend that you 
contact Customer Service at Applied Microsystems Corporation (1-800-426-3925) if 
you experience any problems that do not fall within this range of items. Before you 
call our service department, display your software revision number by typing REV 
(page 5-134). You will be asked for this when you call. 

We do not recommend a component-level repair in the field, unless performed by a 
qualified service engineer. 
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Troubleshooting 


SYMPTOM 


POSSIBLE CAUSES 


Target system 


1. Faulty interconnect cables 


runs erratically 






2. Broken pin on adapter 




3. ES 1800 emulator and target system not compatible 




4. LDV not executed before RUN (vector not loaded). 


Emulator will 


1. Baud rate set incorrectly. 


not communicate 




over RS232 


2. Target system requires "null" modem 




cable (pin 2 and pin 3 of RS232 connector 




reversed). 




3. For terminal operation, thumbwheel switch located 




on the top card is not in the "0" position or 




the cable is not properly attached to the 




terminal port in the back of the ES 1800. 




4. Cable not going to correct port of the terminal 




or PC. 




5. Toggle switch located on the second card from the 




top in the ES 1800 not in the middle position. 




6. Power LED not on. 




7. Cards not seated properly. 
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ES 1800 Emulator Specifications 



Input Power 

Standard 



Optional 



90 to 130 VAC 
47 to 60 Hz 

consumption less than 130W 
180 to 260 VAC 
47 to 50 Hz 

consumption less than 130W 



Environmental 

Operating Temperature 
Storage Temperature 
Humidity 



0 0 C to 40 ° C (32 ° F to 104 ° F) 

-40°Cto70°C(-40°Fto 158 °F) 

5% to 95% relative humidity, noncondensing 



Physical 

Mainframe 13.2 cm x 43.18 cm. x 34.29 cm. 

(6.2 in. x 17 in. x 13.5 in) 
Emulator Pod 22.6 cm. x 12.9 cm. x 4.1 cm. 

(8.9 in. x 5.1 in. x 1.6 in.) 

Target System Connection (total length including pod) 

1.5 m (60 inches) 



LSAPod 

Total Weight 
Shipping 



12.4 cm. x 7.9 cm. x 2.3 cm. 
(4.9 in. x 3.1 in. x .9 in.) 
9.1 kg. (20 lbs.) 
10.9 kg. (24 lbs.) 
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Structure of the ES Language 

The command language used to control the ES 1800 emulator is a formal language. 
Once you understand the basic concepts of this language, you can apply the full 
debugging power of the ES 1800. An overview of the structure of the ES language is 
presented in the accompanying table. A more detailed description of the language 
elements, the help menus, prompts, special operating modes, and ES language error 
messages are also included in this section. Items in angle brackets (<>) are 
mandatory and must be entered as part of the command. 

Items shown in square brackets ( [ ] ) are optional. Do not type the angle or square 
brackets when typing a command. 

If the ESL command interpreter detects an illegal statement, it beeps and places a 
question mark under the command line at the position the error was detected. 
Entering a ? following an error will cause the appropriate error message to be 
displayed. 
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ES Language Syntax 



Language Element 






Example 


Command Line 








[Repeat] Command Statement [;Cmd Statement] 




<**T>T? THT'DXTS. 
<.ivt* 1 UKJN > 


Single Character 1 Instant Command 








Repeat 








<*> *STP;DT 














*9 STP;DT 


Repeat Limit: 








32 

Decimal number only (1 to 2 -1) 






87651234 


Command Statement 








Command Mnemonic 






DTB 


Command Mnemonic <Expression> 






MM pr + 4 


Command Mnemonic <Expression List> 






JLl i U ; TT -L *4 


Assignment Command 






DO = 0FA9 


Expression 






2 * GR5 


Event Monitor System Control Statement 






WHE AC1 THE BRK 


Single Character Instant Command 








</> (repeat previous command line) 








<,> (execute macro 1 or decrement scroll 


in 


memory 


mode) 


< B > (execute macro 2 or increment scroll 


in 


memory 


mode) 


<?> (help) 








Command Mnemonic 








<1 or more alpha chars. >[1 or more dec. 


chars . ] 


ASM 


Expression 








[Unary Operator] lvalue 






-2473 


lvalue <Operator> Expression 






2 - 3F6C90 


<@> Expression 






@240;@@A7 


<(> Expression <) > 






2 * (-2 + 3) 
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Language Element 


Example 


lvalue : 




Symbol 


'main 


Nvalue 




Symbol : 




<'><1 or more printable chars. ><sp or cr> 




Nvalue : 




Number 


7FA3 6 


Register Name 


AO 


Register Name: 




<1 - 3 alpha chars. >[0 - 2 dec. digits] 




Number : 




[Base]<l or more digits> 


%0101001 


Base : 




<%> (binary) 




<\> (octal) 




<#> (decimal) 




<$> (hexadecimal) 




Expression List 




Expression <,> Expression [,Expr. list]... 


1,PC, 2+2, -6 


Assignment Command 




Svalue <=> Expression 


A6 = gOFFFFO 


<@> Expression <=> Expression 


@ (A6 + 5) = GD3 


Svalue : 




Symbol 


' Test_result 


Register Name 


MMP 
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L/iUlgUdgC HrlClilCllt 


17 yq tyi nip 


Event Monitor System Control Statement 






WHF API THF RRK 


Group : 




<1> 




<2> 


2 WHE AC1 THE BRK 


<3> 




<4> 




Event : 




[Disjunctive] <Event Comparator> 


NOT AC1 


Event <Con junctive> <Event> 


DC2 OR NOT AC1 


Disjunctive : 




<NOT> 




Event Comparator 




<AC1> [ .Group] 


AC1.3 


<AC2> [ .Group] 




<DC1> [ .Group] 




<DC2> [ .Group] 




<S1> [ .Group] 




<S2> [ -Group] 




<CL> [ .Group] 


CL . 4 


<LSA> [ .Group] 




Conjunctive : 




<AND> 




<OR> 




Action List 




<Action> [ , Action] . . . 


TRC, TGR, FSI 
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Language Element 


Example 


Action : 




<BRK> 




<TRC> 




<TOT> 




<CNT> 




<TOC> 




<RCT> 




<TGR> 




<FSI> 




<GRO Group> 


GRO 3 


Unary Operator 




<ABS> 


Ado LrJJ o 


< I > 


! UhA 


<-> 


-3 


Operator 




Mul . op 




Add . op 




Shf t . op 




<&> 


GD4 & OFF 


<"> 


DC2.3 " OFF00 


Mul .Op 




<*> 


2*3 


</> 


OFAC / %01001 


<MOD> 


GD5 MOD 7 


Add . op 




<+> 


GRO + A7 


<-> 


@(A7 - 4) 


Shf t .op 




«<> 


DC1 « 3 


<»> 





4-5 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



Notes on ESL 

Command Line A command line is created by entering one or more 

characters after the ESL prompt (see page 4-24 for a 
description of the various prompts). One or more 
command statements can be placed on a single command 
line. Multiple command statements must be separated by 
a semicolon. The command line is limited to 76 
characters and must be terminated with a return. The 
only way to extend command lines is by using macros 
(see page 5-116). 

Backspace or delete characters may be used to delete the 
previous character entered on a command line. CTRL X 
deletes the entire line. CTRL R redisplays the current 
line (useful for hardcopy terminals). 

Repeat If an asterisk ( * ) is the first character on the command 

line, the entire command line will be repeated 
indefinitely. If the asterisk is followed immediately by a 
decimal number, the command will be executed that 
many times. A repeating command line may also be 
terminated by setting the TST register to zero within the 
command line. This provides the simple but powerful 
ability to repeat something until a condition is met 

Command Statement There are several special modes in which the normal 

command statement rules do not apply. In memory mode 
(see page 6-42), entering a <return> on an empty line 
causes the next location to be read. Entering a value 
followed by <return> will cause that value to be written 
to memory. The line assembler (see page 6-34), memory 
disassembler (page 6-39), and main help menu (page 4- 
18) all have special modes which prevent the normal 
execution of ESL commands. 

Single Character Instant Commands 

These commands are processed immediately when they 
are the first character entered on a command line. The 
forward slash character ( / ) will cause the previously 
entered command line to be repeated. 
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>STP 
>/ 

_>/ 

This example single steps three times. 

The comma ( , ) executes macro 1 and the period ( . ) 
executes macro 2. However, if you are in memory mode, 
the period moves you to the next higher memory address 
while the comma moves you to the next lower address. 

The question mark (?) also has two uses. It can be 
entered after the command interpreter detects an error and 
beeps. If you are 'beeped,' enter a ? and the command 
processor will give you an error message describing the 
problem it detected. 

A ? entered at any other time (i.e., not after an error), 
causes a two-page help menu to be displayed. A <return> 
moves you from the first page to the second. Any other 
character terminates the help menu. 

Command Mnemonics Command mnemonics are the alpha-numeric character 

strings that identify a specific ESL command. Command 
mnemonics are formed from 1 to 3 alpha characters 
followed by 0 to 2 numeric characters. Extra characters 
in between are ignored. For example, WHEN is the same 
as WHE and GR12345 is the same as GR45. See the 
Appendices for a list of all ES Language mnemonics. 

Expression An expression can be an integer value, an alpha/numeric 

value or an equation. 

Parentheses may be used to alter the normal precedence 
of operations. The ES 1800 emulator recognizes 
parentheses just as they are treated in algebraic equations. 
You can use as many levels of parentheses as you need. 
The only limitation is that statements can be no more than 
76 characters long. 

Parentheses are not allowed in WHEN/THEN clauses. 

The expression processor can resolve arbitrarily complex 
expressions. 
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@(GD0 +3) = PC + #100 * (DO » 4) +0AF34 

This example retrieves the value of the DO register, shifts 
it right 4-bit positions (divide by 2 ), multiplies the result 
by 100 decimal, adds 0AF34 and the contents of the PC 
register, and writes the result to the location 3 bytes 
above the address in GD0. 

A more common and useful example might be: 

ASM PC + 4 

This computes the address PC + 4, and starts up the line 
assembler at that address. The expression: 

' interrupt + 1A6 

by itself will add 1A6 to the current value of the symbol 
interrupt and display the result. If you don't assign the 
results of an expression to a location or register, the result 
is displayed as a 32-bit value. 

The 8 operator is an indirection operator. 8 Exp 
(where Exp is an expression) refers to the value in 
memory at the address Exp. If the 8 Exp is on the left 
side of an = then the value from the right side of the = 
will be loaded into memory at the address Exp. At all 
other times, 8 Exp simply reads a value from memory. 
@USP is a simple way to read something from the stack 
pointer. It is legal to have multiple indirections, eg., 
88GR0 = 888 (USP + 6). Byte mode and word 
mode affect the length of data transferred to or from the 
target by the 8 operator. (See page 4-24 for more 
information on BYT/WRD/LWM modes.) 

All other math or logic operations are evaluated 
according to the order given in the following section on 
operators. Parentheses may be used to alter the normal 
precedence. Unary operations must be enclosed in 
parentheses if they occur within another expression; eg., 
2+-1 is illegal, but 2+(-l) and -1+2 are legal. 

Certain combinations of expression types and operators 
are illegal or have complex results. See the "Results of 
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Dyadic Operator Combinations" table on page 4-17. 

Some commands can accept a variety of argument types. 
The display block ( DB) command accepts an integer, a 
range, or no argument at all. Other commands require 
that a certain argument type be used. The upload UPL 
command requires a range argument See the discussion 
on Numbers (below) for types. 

Symbols If you have the symbolic debug option installed in your 

ES 1800 emulator, you can use symbolic references. 
Every symbol must begin with a single quote ( ' ). 
Symbols are composed of 1 to 64 printable characters 
followed by a space or <retum> . Symbols can be used 
anywhere a register or a number is used, with the 
exceptions that symbols are not valid with the colon 
operator or the repeat ( * ) operator. 

Numbers The ES 1800 has a default base register. It is assumed 

that numbers entered without a leading base character are 
being entered in the default base. Generally, the default 
base is hexadecimal (factory default). See page 5-83 for 
more information in changing the default base register. 

There are three different types of numbers. 

1. An integer is a 32-bit signed value. 

2. A don't care is a 32-bit value with a 32-bit mask. 
For each-bit set in the mask, the corresponding-bit 
position in the value is ignored during Event 
Monitor comparisons. Don't cares can be entered 
in two ways. 1234 DC 0FF0 is explicit. 
1XX4 is equivalent to 1FF4 DC 0FF0. Don't 
cares are useful for setting the Event Monitor 
System Event Comparators (see pages 7-2, 8-2). 

3. A range is specified by entering a start address and 
a length or an endpoint. 200 LEN 20 is the 
same as 200 TO 2 IF. Ranges can be either 
internal (default) or external. An explicit range 
type can be specified by using the prefix IRA or 
XRA. 0 LEN 100 is the same as 
IRA 0 LEN 100. The ! operator inverts the 
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type of a range value. ! (0 LEN 100) is the 
same as XRA 0 LEN 100 which means 
everything but addresses 1 to 00FF. The endpoints 
are always included in the range. Regardless of the 
method of entering (TO, LEN), range values are 
always displayed as 'start TO end.' 

Ranges, don't cares, and integers are not generally 
interchangeable. Certain registers can only hold certain 
data types. All registers can hold integers. Address type 
registers cannot be loaded with don't care values. Status 
and data registers cannot be loaded with range values. 
See page 5-68 for a list of all registers and their data 
types. 

Base To enter a character in any base other than the default, use 

a leading base character: % = binary, \ = octal, # = 
decimal, and $ = hexadecimal. 

Expression List Lists are required by a few commands. They can also be 

used for implicit evaluation. For example, in pause mode, 
entering the three numbers %010011010, #128, 
\77347 causes the emulator to display their equivalent 
in the default display base (usually hexadecimal). Lists 
are limited to nine elements. Lists are used in memory 
mode as well. 

Assignment Command Svalues are the names of registers or symbolic references. 

The form ^Expression = Expression will cause 
the left side expression to be calculated and used as an 
address at which to store the value of the right side 
expression. Note that since @ Express ion is itself an 
expression, commands such as @A7 = 0 are legal and 
useful. 

The following example assigns the value on the right 
($47FF) to the AO register. 

AO = $47FF 

The ES 1800 displays nothing in response to this entry. 
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Verify by: 

>A0 

$000047FF 

In the following example the expression $121 + $4 is 
calculated. 



AO = $121 + $4 

The register AO is then assigned the value $125. Your 
console screen will not display this entry. Verify by: 

>A0 
$125 



Registers Registers are grouped into three types: integer only, don't 

care, and range. Any register can be assigned an integer 
value. Don't care registers can be loaded with don't care 
values or integers but not ranges. Range registers can be 
loaded with integers or ranges but not don't care values. 
See page 5-68 for a list of all registers and their data 
types. 

Indirection Operator The indirection operator § allows expressions to include 

values transferred to or from the target system memory 
address space. The expression becomes the address of a 
target system byte, word, or long word. 

More than one @ operator in an expression displays a 
quantity pointed to by another quantity located in the 
target system memory. The emulator evaluates the 
expression following the @ operators, considers it an 
address, and looks at the value stored at this address. The 
value at this address is also considered to be an address. 
This address is accessed and displayed. 
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Parentheses may be used to affect the processing of the § 
operator: 

>@ GD4 + 6 
>@ (GD4 + 6) 

In the first example the indirection operator is applied to 
GD4. The command interpreter accesses the target 
system location pointed at by GD4, adds six to the value 
stored there, and displays the final results. 

In the second example, the ES 1800 displays the value 
stored in the sixth location above the address pointed to 
by GD4. 

The indirection operator can be used to write values to 
memory-mapped I/O without causing a read after write. 
Memory mode always executes memory reads. This may 
be unacceptable for certain hardware configurations. To 
store values without entering memory mode, use: 

>@ <address> = <data> 

This causes the system to load data into the specified 
address. 

Event Monitor System Control Statement 

Event Monitor System statements describe combinations 
of target program conditions and the corresponding 
actions to be taken if the conditions are met; they do not 
describe mathematical or logical computations. Be aware 
that normal expression operators are illegal when 
specifying Event Monitor System statements. These 
statements are discussed in detail in Section 7 
(68000/08/10) or Section 8 (68020), Event Monitor 
System. 

Group The Event Monitor System (EMS) is arranged in four 

independent groups. These groups provide a state- 
machine capability for debugging difficult problems. An 
EMS control statement can only be associated with one of 
the four groups. If no group numbers are mentioned in the 
EMS control statement, the statement is assigned to group 
1. There are two ways to override this default selection 
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of group 1. You can begin the EMS control statement 
with a group number, or you can append a group number 
to any one of the event comparator names. For example: 
3 WHEN AC1 THEN BRK is functionally the same as 
WHEN AC1.3 THEN BRK; both use group 3. You 
cannot mix group numbers within a single EMS control 
statement. 

You can define an event to be some combination of 
address, data, status, count and logic state probe 
conditions. Numerous Event Monitor System control 
statements can be entered and will be in effect 
simultaneously. Conflicting statements may cause 
unpredictable action processing. Parentheses are not 
allowed in event specifications. 

The NOT operator is used to reverse the sense of the 
comparator output NOT has higher precedence than 
either of the conjunctives, AND and OR. 

WHEN AC1 AND NOT DCl THEN BRK 

This statement means break whenever any data pattern 
other than that in DCl is written to the address in ACL 

Conjunctive AND and OR can be used where needed to form more 

restrictive event definitions. AND terms have higher 
precedence than OR terms. 

ACl AND DCl OR DC2 

This event is equivalent to ACl AND DCl in one 
statement and DC2 in another. If you are looking for two 
different data values at an address, you would use: 

ACl AND DCl OR ACl AND DC2 

The OR operator is evaluated left to right and is useful for 
simple comparator combinations. For complex event 
specifications, OR combinations can be replaced with 
separate EMS control statements for clarity. 



Event 



Disjunctive 
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ACl AND SI OR AC 2 AND S2 



This event is the same as ACl AND SI and 
AC2 AND S2 in separate statements. 

Unary Operator All internal computations use 32-bit math. Values 

entered with a leading - are converted to signed 
numbers; e.g., -1 is stored internally as $ffffffff. 
Internal math however, is signed only for the +, *, 
/ operations; -5+3 is $FFFFFFFE, while -1 » 1 
is reduced to $7fffffff. 

ABS converts a signed number to its absolute value. 

! is a logical NOT operator and complements all 32 bits 
of a number. If the number is a range, the range type 
(internal or external) is inverted. 

Unary operators have the highest precedence. -2+3 is 
1. 

Operator The operators are listed below in descending order of 

precedence. Operators of the same type are evaluated left 
to right. 



Mul .op: 




* 


Multiply 


/ 


Divide 


MOD 


Modulo 


Add . op : 




+ 


Add 




Subtract 


Shft .op: 




>> 


Right shift 


« 


Left shift 


& 


Logical AND 




Logical OR 
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Modulo (MOD) 



The result of this operation is the remainder after the 
value on the left has been divided by the value on the 
right. 



>2 9 MOD 4 
results = 1 
>38 MOD 6 
result = 2 
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Results of Single-Argument Operators 



Operator 


Argument 


Result 








I 


Integer 


Valid 












UUIl L. Laic 




a re n ot 






IRA 


Complement 


(IRA 


becomes 


XRA) 


ABS 


Integer 


Valid 










DC 


Don't care 


bits 


are not 


affected 




IRA 


Invalid 










XRA 


Invalid 








- 


Integer 


Valid 










DC 


Don't care 


bits 


are not 


affected 




IRA 


Invalid 










XRA 


Invalid 








@ 


Integer 


Valid 










DC 


Invalid 










IRA 


Invalid 










XRA 


Invalid 
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Results of Dyadic Operator Combinations 



Left Hand 
Expression 


Right Hand 
Expression 


Operator 


Result 


Integer 


Integer 


* / MOD 


Valid 








Valid 






« » 


Valid 






+ - 


Valid 


Integer 


Don't care 


MOD 


Illegal 






* / 


Don't care bits are passed 








to the left hand argument. 






& " 


Don't care bits are passed 








to the left hand argument. 






« » 


Don't care bits are passed 








to the left hand argument. 


Integer 


IRA XRA 


* / MOD 


Invalid 






&~ 


Invalid 






« » 


Invalid 






+ - 


The endpoints of the range 








will be altered by the 








value of the integer 








expression. 


Don't care 


Don't care 


* / MOD 


Invalid 






& ' 


Invalid 






« » 


Invalid 






+ - 


Don't care bits are ANDed. 


Don't care 


Integer 


* / MOD 


Don't care bits are kept. 








Valid 






« » 


Don't care-bit positions 








are shifted. 






+ - 


Don't care bits are kept. 


IRA, XRA 


Integer 


* / MOD 


Invalid 






& " 


Invalid 






« » 


Invalid 






+ - 


The end points of the 








range will be altered by 








the value of the integer 








expressed. 



4-17 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



Help 

There are two pages of help information available. The 68020 help menu differs 
from the 68000/08/10 menu. Enter a ? as the first character of a command line to 
display the first help page. This page gives examples of the most commonly used 
commands and their meanings. The second page describes the Event Monitor 
System registers and commands. Enter a <return> at the end of the first page to move 
to the second page. The menus are shown on the next four pages. 

Information on switch settings, configuration settings, and special functions is 
available without using the ? help menus. Other help information is described below. 

Software Switches Enter either ON or OFF to display the current 

settings and definitions of all software switches, 
(see page 5-10). 

Communications Set-up Enter SET to display the current configuration 

settings and possible values (see page 5-3). 

Special Diagnostic Functions Enter SF to display a list of the available special 

functions (RAM/ROM tests, scope loops, etc.) 
(see page 6-50). 
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First Page of Help Menu (68000/08/10) 



>? 

RUN/EMULATION: 
STP - SINGLE STEP/STOP 
RST - RESET TARGET SYSTEM 



RUN/RNV - RUN/ RUN WITH NEW VECTORS 
RBK/RBV - RUN TO BREAKPOINT /WITH VECTORS 
WAIT - WAIT UNTIL EMULATION BREAK 



TRACE HISTORY: 
DT - DISASSEMBLE MOST RECENT LINE 



DTB/DTF-DISASSEMBLE PAGE BACK/ FORWARD 
DRT (X> -DISPLAY PAGE RAW TRACE (FROM X) 



MEMORY - REGISTER COMMANDS: 
DB X TO Y - DISPLAY BLOCK 
BMO X TO Y, Z - BLOCK MOVE TO Z 
MMS = ALT, COD, DAT, STA 
X - EXIT MEMORY MODE 



DR - DISPLAY ALL CPU REGISTERS 
FILL X TO Y, Z - FILL BLOCK WITH Z 
LOV/VFO X TO Y - LOAD/VERIFY OVERLAY 
DEFINES STATUS LINES FOR MEMORY ACCESS 
MX- VIEW/CHANGE MEMORY AT X 



MEMORY MAPPING: 
MAP X TO Y :RO 



OVE = DC, DAT 

DM/CLM - DISPLAY/CLEAR MEMORY MAP 



COMMUNICATIONS: 
DNL - DOWNLOAD HEX FILE FROM HOST 
UP L X TO Y - UPLOAD HEX TO HOST 



TRA - TRANSPARENT MODE TERMINAL-HOST 
CCT - TRANSFER CONTROL TO COMPUTER PORT 
TCT - TRANSFER CONTROL TO TERMINAL PORT 



SYSTEM: 

ON/OFF - VIEW/ALTER SWITCHES 
ASM (X) - IN LINE ASSEMBLER 



SET - VIEW /ALTER SYSTEM PARAMETERS 
SF - VIEW/EXECUTE SPECIAL FUNCTIONS 
DIS(X) DISASSEMBLE FROM MEMORY 



LD/SAV (X) - LOAD/SAVE 0=SETUP, 1-REGS, 2-EVENTS, 3=MAP , 4=SWITCHES, 5=MACROS 
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Second Page of Help Menu (68000/08/10) 



EVENT MONITOR SYSTEM 

DES - DISPLAY ALL EVENT SPECIFICATIONS 

CES - CLEAR ALL EVENT SPECIFICATIONS 

DES X - DISPLAY ALL EVENT SPECIFICATIONS FOR GROUP X 

CES X - CLEAR ALL EVENT SPECIFICATIONS FOR GROUP X 



EVENT ACTIONS: 

BRK - BREAK CNT - COUNT EVENT TGR - TTL TRIGGER STROBE 

TRC - TRACE EVENT RCT - RESET COUNTER FSI - FORCE SPECIAL INTERRUPT 

TOT - TOGGLE TRACE TOC - TOGGLE COUNT GROUP X - SWITCH TO GROUP X 



EVENT DETECTORS - GROUPS 1, 2, 3, 4: 

AC1,AC2 OR AC1.X,AC2.X - 24-BIT DISCRETE ADDRESS OR INTERNAL EXTERNAL RANGE 
DC1,DC2 OR DC1.X,DC2.X - 16-BIT DATA, MAY INCLUDE DON'T CARE BITS 
S1,S2 OR S1.X,S2.X - STATUS AND CONTROL - BYT/WRD + RD/WR + TAR/OVL 

+ MEM/ I OA + IAK/RIO/WIO/HLT/IF/RM/WM/NBC 

+ ALT/COD/DAT/STA 
LSA - 16 LOGIC STATE LINES, MAY INCLUDE DON'T CARE BITS 

CL - COUNT LIMIT, ANY NUMBER 1 TO 65,535 



STEP 1 - ASSIGN EVENT DETECTORS 
STEP 2 - CREATE EVENT SPECIFICATIONS 

AC1 = $1234; Si = BYT + RM WHEN AC1 AND SI THEN GROUP 2 

AC1.2 = $4576+14*6;DC2.2 - $5600 DC $FF 2 WHEN AC1 AND NOT DC2 THEN CNT 

CL.2 - 24;AC2.2 = $F000 LEN $400 WHEN CL.2 OR AC2.2 THEN BRK 
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First Page of Help Menu (68020) 



>? 

RUN/ EMULATION: 
STP - SINGLE STEP/STOP 
RST - RESET TARGET SYSTEM 



RUN/RNV - RUN/ RUN WITH NEW VECTORS 
RBK/RBV - RUN TO BREAKPOINT /WITH VECTORS 
WAIT - WAIT UNTIL EMULATION BREAK 



TRACE HISTORY: 
DRT X TO Y - DISPLAY TRACE RANGE 



DRT (X) -DISPLAY PAGE RAW TRACE (FROM X) 



MEMORY - REGISTER COMMANDS: 
DB ( . BWL) X TO Y - DISPLAY BLOCK 
FIL X TO Y,Z - FILL BLOCK WITH Z 
BMO X TO Y,Z - BLOCK MOVE TO Z 
VBM X TO Y, Z - VERIFY BLOCK MOVE 
M (X) - VIEW /CHANGE MEMORY (AT X) 
MMS/MMD = SCO-SC7,SP,SD,UP,UD,CPU 



DR - DISPLAY ALL CPU REGISTERS 
CLR - CLEAR ADDRESS AND DATA REGISTERS 
VBL X TO Y, Z - VERIFY BLOCK CONTAINS Z 
LOV/VFO X TO Y - LOAD /VERIFY OVERLAY 
X - EXIT MEMORY MODE 

. B, . W, . L - DATA LENGTH; BYTE, WORD, LONG 
STATUS FOR MEMORY ACCESS; SOURCE/DEST 



COMMUNICATIONS: 
DNL - DOWNLOAD HEX FILE FROM HOST 
UP L X TO Y - UPLOAD HEX TO HOST 



TRA - TRANSPARENT MODE TERMINAL-HOST 
CCT - TRANSFER CONTROL TO COMPUTER PORT 
TCT - TRANSFER CONTROL TO TERMINAL PORT 



SYSTEM: 

BUS - VIEW HARDWARE STATUS LINES 
ON /OFF - VIEW/ALTER SWITCHES 
MAC/CMC - DISPLAY/CLEAR MACROS 



SET - VIEW /ALTER SYSTEM PARAMETERS 
SZ (.BWL) - SET DEFAULT DATA LENGTH 
SF - VIEW/EXECUTE SPECIAL FUNCTIONS 
DIS/ASM (X) DIS/ASSEMBLE FROM/TO MEMORY 



LD/SAV (X) - LOAD/SAVE 0=SETUP , 1-REGS, 2-EVENTS, 3=MAP , 4=SWITCHES, 5=MACROS 
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MEMORY MAPPING: OVE = SCO-SC7+SP+SD+UP+US+CPU; OVS = 2-5 

MAP X TO Y :RO :RW : TGT :ILG DM/CLM - DISPLAY/CLEAR MEMORY MAP 

EVENT MONITOR SYSTEM 

DES/CES (X) - DISPLAY/ CLEAR ALL EVENT SPECIFICATIONS (FOR GROUP X) 



EVENT ACTIONS: 

BRK - BREAK CNT 

TRC - TRACE EVENT RCT 

TOT - TOGGLE TRACE TOC 



- COUNT EVENT TGR 

- RESET COUNTER FSI 

- TOGGLE COUNT GROUP X 



TTL TRIGGER STROBE 
FORCE SPECIAL INTERRUPT 
SWITCH TO GROUP X 



EVENT DETECTORS - GROUPS 1,2,3,4: 

AC1,AC2 OR AC1.X,AC2.X - 24 BIT DISCRETE ADDRESS OR INTERNAL EXTERNAL RANGE 
DC1,DC2 OR DC1.X,DC2.X - 16 BIT DATA, MAY INCLUDE DON'T CARE BITS 
S1,S2 OR S1.X,S2.X - STATUS AND CONTROL - BYT/WRD + RD/WR + TAR/OVL 

+ SP/SD/UP /UD/SCO-SC7 + IPO .. IP7 + BER _ AV + IP 
LSA - 16 LOGIC STATE LINES, MAY INCLUDE DON'T CARE BITS 

CL - COUNT LIMIT, ANY NUMBER 1 TO 65,535 



STEP 1 - ASSIGN EVENT DETECTORS 
AC1 = $1234; SI = SP + RD 

AC1.2 = $4576+14*6;DC2.2 = $5600 DC $FF 
CL.2 - 24;AC2.2 = $F000 LEN $400 



STEP 2 - CREATE EVENT SPECIFICATIONS 
WHEN AC1 AND SI THEN GROUP 2 
WHEN AC1 AND NOT DC2 THEN CNT 
WHEN C<.2 OR AC2.2 THEN BRK 
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Log In Banner 

After initial power on, the log in banner should appear on your console screen. After 
a reset, the first three lines and the last line of the banner appear on your screen. 



COPYRIGHT 198X 

APPLIED MICROSYSTEMS CORPORATION 
SATELLITE EMULATOR 6 8 XXX VX.XX 

USER = SW= 

# K AVAILABLE OVERLAY 

CLOCK FREQUENCY = KHZ 



Satellite Emulator The microprocessor type is that of the target system. 

Refer to the Motorola reference manual for more 
information. 

The version number reflects the released version of the 
ES language software for the emulator. 

The user number and software number (SW) indicate the 
positioning of the thumbwheel switch on the ES 1800 
main control board (refer to page 3-5). 

The amount of overlay memory indicated depends on the 
amount installed in the system. This can be 128K, 256K, 
512K, 1M or 2M of memory. 

clock frequency= KHZ This line displays the target clock frequency at which the 

CPU is operating. This display appears only with the 
68020 emulator. 



VX.XX 



USER= SW= 



# K AVAILABLE OVERL/V 



>No Target VCC 



The console screen displays a NO TARGET VCC (see 
error message page B15) when you are not connected to a 
target system. 

A CTRL Z clears this display message and returns the 
system to the log in banner for reentry of an input 
command. 

NOTE: Refer to page 3-10 Null Target System Simulation 
Tool, for using the ES 1800 emulator without a target 
system. 
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Prompt The pause mode prompt > indicates that the ES 1800 is 

not running, is in a pause mode and is ready to receive 
instructions. Make sure that the > shows before you 
enter any command. 

If the > does not appear after the log in banner: turn off 
the equipment, check the connections, and then repeat the 
power-up sequence. 

Check for proper connection of the cable between the 
terminal and the ES 1800. 

Check the cable connecting the pod to the ES 1800. Is it 
completely secured? 

Check to see if the pod probe package is completely 
plugged into the target system. 

If the unit has just been shipped, one or more of the 
boards may have become loose in the ES 1800 chassis. 
Check for loose boards. 

If an error message appears, refer to the given message in Appendix B. 



4-24 



ES Language 



Prompts 

Different prompts are displayed depending on the current operating mode of the 



ES 1800. 



R> 



The standard, or pause mode prompt from ESL consists of 
a space character followed by a right arrow. 

During emulation, the run mode prompt is displayed. 
Most ESL commands are still valid. 



$12345678 $00 > 
$12345678 $00 R> 
$12345678 $0000 > 

$12345678 $0000 R> In memory mode, the prompt includes the memory 

address and the data contained there. Depending on 
whether byte mode, word mode, or long word mode 
(BYM, WDM, LWM) has been chosen, the data will be a 
byte, a word or a long word. The 'run' prompt (R>) may 
also be present during memory mode. 

$000000 $FF> 
$000000 $FFFF> 

$000000 $FFFFFFFF> These three memory mode prompts will display to 

indicate whether the system is in an 8 bit, 16-bit or 32-bit 
mode, respectively, for displaying your address and data. 

**** 680XX LINE ASSEMBLER **** 

000100 > The 68000/08/10 line assembler displays a 16-bit address 

prompt The 68020 line assembler displays a 32-bit 
address. This prompt contains an R if you are 
assembling during emulation. 
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Special Modes 

You can enter special modes during emulation, some of which must be exited before 
using regular ESL commands. These modes can be identified by the prompt 
displayed. 

Byte Model Word Model 
Long Word Mode 

The BYM, WDM and LWM commands select byte, 
word and long word mode operation. The mode selected 
determines whether 8, 16 or 32-bit data is used or 
displayed. If byte mode is set, most data commands use 
byte values; the same is true of word and long word 
modes. 

More compatible with the Motorola style of value display 
is the SZ command. To designate globally what memory 
address and data pattern the system will display, enter the 
SZ mnemonic, specify the mode with a dot operator and 
press return: SZ<.B,.W,.L> 

Memory address and data patterns will globally display in 
the specified mode: SZ.B displays in byte mode. SZ.W 
displays in word mode. SZ.L displays in long word 
mode. 

You can temporarily override the byte, word and long 
word address and data display prompts by keying in the 
dot operators (.B, .W, .L) after a command. For example: 
DB.B means a block of memory is displayed in byte 
mode. DB.W means a block of memory is displayed in 
word mode. DB.L means a block of memory is displayed 
in long word mode. 

The dot operators may also be used with the indirection 
operator (@ ) e.g. 6 .B (183+1) . 

When the indirection operator is used (@), long word 
mode is the dot operator default extension regardless of 
the system default mode. To change this you must 
specify .Bor .W. 
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Line Assembler The 68000/08/10 line assembler has a single 16-bit 

address prompt The 68020 line assembler has a 32-bit 
address prompt Exit by entering an X or the END 
directive. 

Memory Disassembler If initiated without a range argument the memory 

disassembler (DIS) displays a full page of data, leaving 
the cursor at the lower right corner of the screen. A 
<return> displays the next page of disassembled memory. 
A <space> causes only the next instruction to be 
disassembled. Any other character terminates memory 
disassembly. 

Memory mode has an address and data prompt Exit by 
entering an X. 

No characters are generated by the ES 1800. Exit by 
entering the two character escape sequence (default is 
<esc> <esc> ), or reset (default Ctrl z ). 

Many diagnostic functions are designed to run 
continuously. The message from the function will inform 
you to enter the reset character (default is Ctrl Z ) to 
terminate the function. 

Repeating Command Lines It is easy to inadvertently create an indefinitely repeating 

command that does not display anything. Terminate such 
commands with the reset character (default is Ctrl z ). 

Special Characters 

DELETE BACKSPACE Either character deletes a character just entered on a 

command line. 

CTRL X Deletes an entire command line. 

CTRLR Redisplays the current command line (for hardcopy 

terminals). 

CTRLZ The default reset character. CTRL z resets the 

emulator, stops emulation and/or clears an error 
condition. It does not clear or update emulator registers. It 
is also used to terminate certain diagnostic functions. 
CTRL z terminates an indefinitely repeating command. 



Memory Mode 
Transparent Mode 

Special Functions 
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You can change reset character (see page 5-3). 

ESC ESC The default transparent mode escape sequence, used to 

terminate transparent mode. You can change the 
transparent mode escape sequence (see page 5-3). 

CTRL S The XOFF character. When issued from the keyboard, 

the screen display stops scrolling, allowing you to view 
the information. You can change the XOFF character 
(see page 5-3). 

CTRL Q The XON character. Restarts the screen display after an 

XOFF is issued. You can change the XON character (see 
page 5-3). 
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Introduction 

This section provides a reference to commands that control the emulator system. It is 
divided into sections on setup commands, serial communications, download 
operations, registers, trace memory, macros and symbols. 

Set-Up Commands 

The SET and ON/OFF commands allow you to configure the ES 1800 according to 
hardware and debugging needs. There are two menus containing variables that are 
software selectable for quick and easy changes. 

The SET menu contains all of the external communication variables such as baud 
rates, parity, and upload/download data format. Some set parameters require a reset 
before becoming effective. You can also set the serial communication parameters and 
save them to EEPROM without affecting the parameters currently in use. 

The ON/OFF menu contains switches that control emulation and the serial port copy 
switch. For example, the copy switch copies data to both serial ports for obtaining 
hard copy of your emulation session. 

The SET menu and the ON/OFF menu can be saved to EEPROM after you have set 
them. These values may then be automatically loaded into the ES 1800 on power-up 
by setting the thumbwheel switch to the appropriate value, or manually by typing a 
load command (LD) to the ES 1800 after power-up. 
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The EEPROM is divided into two groups of six sections. Each section within a group 
may be loaded and saved individually. The two Groups designate two users, referred 
to as User 0 or User 1 in the SET menu. This allows two users to save complete 
information about their emulation session, and reload it later. The six sections of 
information are: 



Group # 


Description 


0 


SET menu 


1 


Registers 


2 


Event Monitor WHEN/THEN clauses 


3 


Overlay map 


4 


ON/OFF menu 


5 


Macros 
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Command 



Result 



SET 



Displays the SET menu. The parameters 
in this menu specify the external 
communication details. 



>SET 



SET #X,#Y - SET ITEM X TO VALUE CORRESPONDING TO Y 

LD 0;SAV 0 LOAD /SAVE SETUP FOR CURRENTLY SELECTED USER 

SYSTEM: #1 USER = 0; [0,1] 



#2 RESET CHAR = $1A 
#3 XON, XOFF = $11, $13 

#4 TRACE MODE =2; [0,1,2,3] (68020 ONLY) 

#5 32 BIT COMPARATOR ENABLE = 1; [0,1] (68020 ONLY) 



TERMINAL: #10 BAUD RATE = #14; [2=110,5=300,10=2400,14=9600] 



COMPUTER: #20 BAUD RATE = #14; [7=1200,12=4800,15=19200] 



#21 STOP BITS = 1 
#22 PARITY = 0 

#23 TRANSPARENT MODE ESCAPE SEQUENCE = $1B, $1B 
#24 COMMAND TERMINATOR SEQUENCE = $0D, $00, $00 
#25 UPLOAD RECORD LENGTH = #32; [1 to 127] 

#26 DATA FORMAT = 0; [0=INT, l=MOS, 2=MOT , 3=SIG, 4=TEK, 5=XTEK] 
#27 ACKNOWLEDGE CHAR = $06 



#12 
#13 
#14 



#11 



STOP BITS = 1 [1,2] 

PARITY = 0; [0=NONE, l=EVEN,2=ODD] 

CRT LENGTH = #2 4 

TRANSPARENT MODE ESCAPE SEQUENCE = $1B, $1B 
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SET <parameter> , <exp> The value of the specified parameter is 

changed to <exp>. If you assign an illegal 
value to a variable, an error message is 
displayed, and the value is not changed. 

The table below shows the valid values for 
each SET variable. All arguments 
preceeded with a $ indicate that the value 
entered must be a 7-bit ASCII character. 



Comments 



In the commands that follow, '#' indicates a decimal number. It is not required for 
the numbers 0-9. 
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Parameters 


Description 


Reset 
Required 


SET #1,#0 
SET#1,#1 


UserO 
Userl 

Two users may save and load values to the 
EEPROM. This parameter indicates which 
user is active when executing the SAV and 
LD commands. 


No 
No 


SET#2,$n 


Reset character 

The reset character resets the ES 1800 and 
the pod CPU. The system default is CTRL 
Z($1A). 


No 


SET #3,$n,$m 


XON/XOFF characters 

XON and XOFF control the screen 
scrolling. An XOFF stops a scrolling 
display. XON resumes scrolling the 
display. The system defaults are CTRL Q, 
CTRL S ($13, $11). 


No 


SET #4, 

#0 

#1 

#2 

#3 


Trace Mode (68020 only) 

ModeO 

Mode 1 

Mode 2 

Mode 3 


No 


SET #5, 

#0 

#1 


32 Bit Comparator Enable (68020 only) 
32 bit comparators disabled (see Section 8) 
32 bit comparators enabled (see Section 8) 


No 
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Parameters 


Description 


Reset 
Required 


SFT #10 #1 


7*5 baud 


Yes 


#2 


110 baud 






1 "34 5 hand 




#4 


1 50 baud 




#5 


^00 hand 




#6 


600 hand 




#7 


1200 baud 




#8 


1800 baud 




#9 


2000 baud 




#10 


2400 baud 




#11 


3600 baud 




#12 


4800 hand 

"OVA/ UauU 




#13 


7200 baud 




#14 


9600 baud (default) 




#15 


19200 baud 






The terminal port baud rate 




SET#11,#1 


1 stop bit (default) 


Yes 


#2 


2 stop bits 






The number of stop bits for the 






terminal port 




SET#12,#0 


No parity (default) 


Yes 


#1 


Even parity 




#2 


vuu polity 






The parity for the terminal port 






UK l lengtn (aetauit. ia lines) 


JNO 




The maximum number of lines 






displayed for commands that 






use paging 
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Parameters 


Description 


Reset 
Required 


SET#14,$n,$m 


Transparent mode 






escape sequence 


No 




When entered from either 






port, transparent mode is 






terminated. The default 






sequence is ESC, ESC 






($1B,$1B). 






75 hand 


ICS 


TTLi 


1 1 0 hand 






1 ^4. 5 hand 




#4 

Tr i, t 


1 <50 hand 




#5 


300 hand 




#6 


600 hand 




#7 


1200 baud 




#8 


1800 baud 

J. UVU UUUU 




#9 


2000 baud 




#10 


2400 baud 




#11 


3600 baud 




#12 


4800 baud 




#13 


7200 baud 




#14 


9oUU baud (aetault) 




#15 


19200 baud 






The computer port baud rate 




SET#21,#1 


1 stop bit (default) 


Yes 


#2 


2 stop bits 






The number of stop bits for 






the computer port 
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Parameters 


Description 


Reset 
Required 


SET#22,#0 

#1 

#2 


No parity (default) 
Even parity 
Odd parity 

Parity for the computer port 


Yes 


SET #23,$n,$m 


Transparent mode 
escape sequence 

When entered from the computer 
port, transparent mode is exited. 
The default sequence is ESC, ESC 
($1B,$1B). 


No 


SET #24,$n,$m,$o 


Command terminator sequence 

The default sequence is <return> , 
null, null (SOD, $00, $00). 


No 


SET#25,#n 


Upload record length 

The maximum length for an upload 
record. (The default length is 32 
bytes of data.) 


No 


SET#26,#0 
#1 

#3 
#4 
#5 


Intel 
MOS 

ivioioroid ^ueiduiij 
Signetics 
Tektronix 
Extended Tekhex 

Upload/download serial data format 


No 
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Parameters 


Description 


Reset 
Required 


SET#27,$n 


Acknowledge character 


No 




The acknowledge 






character is sent when 






a valid record is 






received when 






downloading in 






computer control. The 






default is $06. 





Comments 



Some SET parameters require the system to be reset, and will prompt for a reset 
character. If you change a parameter that requires a reset, but do not enter one, 
subsequent displays of the SET menu will show the new value you have assigned the 
variable, even though it is not currently in effect. 

If you have changed the SET parameters and wish to use the new values at a later 
date, you can save them in EEPROM by entering a S AV or SAV 0 command. 

Saved parameters can be loaded automatically at power-up or manually after the 
system is up and running. To load automatically, set the thumbwheel switch (see 
page 3-5) before turning on the ES 1800. To load manually, enter LD (to load all 
variables and settings) or enter LD 0 command (to load just the SET parameters). 

See the Serial Communications section (page 5-30) for information on 
communicating with a host computer. 
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Command Result 



ON Displays the ON/OFF menu. 

OFF Displays the ON/OFF menu. 

ON <switch> Set the specified switch to the ON 

position. 

OFF <switch> Set the specified switch to the OFF 

position. 
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Comments 



The ON/OFF menu appears as follows. 



>ON 






ES 


SWITCH 


SETTINGS 


LD/SAV 


4: LOAD/SAVE SWITCH SETTINGS IN EEPROM 


EXAMPLES: >ON 


BTE + CPY + SLO 




>OFF 


FST + PPT 


VALUE 


NAME 


DESCRIPTION 


OFF 


PPT 


TRACE PEEK/POKE CYCLES 


ON 


BTE 


BUS TIMEOUT ENABLE 


OFF 


FTO 


FAST BUS TIMEOUT 


OFF 


DBP 


DISABLE BUS ERRORS ON PEEKS/POKES 


ON 


SLO 


SLOW INTERRUPT 


OFF 


FST 


FAST INTERRUPT 


OFF 


CAS 


CONTINUOUS ADDRESS STROBE WHILE PAUSED 


OFF 


TAD 


TRI-STATE ADDRESS BUS WHILE PAUSED 


OFF 


SPD 


VIEW BUS TIMING INFO INSTEAD OF IPLS 


OFF 


IM 


INTROSPECTIVE MODE 


ON 


ECS 


CONTINUOUS ECS/OCS WHILE PAUSED (68020 ONLY) 


OFF 


CDS 


CACHE DISABLE (68020 ONLY) 


OFF 


CPY 


COPY DATA TO TERMINAL & COMPUTER PORTS 


ON 
> 


TCE 


TRACE CAPTURE ENABLE (DYNAMIC TRACE ONLY) 



Some ON/OFF switches cannot be set during run mode. See the switch command 
pages for specific information. 

The arguments to the ON and OFF commands are the names of the switches 
themselves. You may turn on or off multiple switches by listing them with a + 
between their names. 

You can save all of the current switch settings in EEPROM for later use with a SAV 
(to save all variables and settings) or SAV 4 (to save just switch settings) command 
(see page 5-26). 

The saved switches can be loaded automatically at power-up or manually after the 
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system is up and running. To load automatically, set the thumbwheel switch (see 
page 3-5). before turning on the emulator. To load manually, enter LD (to load all 
variables and settings) or LD 4 (to load just the switch settings) (see page 5-28). 



Examples 



If you want a hard copy of an emulation session, attach a printer to the computer port 
on the back chassis of the ES 1800. Turn on the copy switch so that all data is copied 
to both serial ports. 



>ON CPY 
> 
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BUS TIME OUT ENABLE 



Command Result 



ONBTE 



OFF BTE 



With BTE switch enabled, the ES 1800 
generates a bus error and breaks emulation 
if a bus cycle is not terminated in a 
reasonable period of time (refer to page 
5-20). A bus error message is displayed 
on the screen. 

Default: ON 

When BTE is off, the ES 1800 does not 
terminate a bus cycle. 



Comments 



When a bus error is detected with BTE either ON or OFF, the entire target system 
stack of registers is saved. These registers are saved in the ES 1800 under specific 
names and may be examined and/or modified. (See page 5-68.) BTE is always 
enabled for peeks/pokes while paused, regardless of switch setting. 
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CONTINUOUS ADDRESS STROBE 



Command Result 



ON CAS 
OFF CAS 



If CAS is ON, the address strobe 
continues to be active in the target system 
while paused. 

If CAS is OFF, the address strobe is active 
only during run mode. 

Default: OFF 



Comments 



Use this software switch to allow the address strobe to go to the target system while 
the ES 1800 is not in run mode. 
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CACHE DISABLE (68020) 



Command Result 



ON CDS 



OFF CDS 



When the cache disable is ON, the CDIS 
pin in the emulator is asserted. The 
microprocessor will not use its cache 
memory. This is necessary if the trace 
disassembler is going to be used. 

When CDS is OFF, the CDIS signal in the 
target system is used. Cache memory will 
operate normally with internal cache 
cycles replacing some of the external bus 
cycles during small loops. 

Default: OFF 



Comments 



You may want to enable the CDS switch if you are disassembling trace memory (see 
page 5-102). 
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COPY DATA TO BOTH PORTS 



Command Result 



ONCPY 



OFF CPY 



Send all data to both the terminal and 
computer ports. Data sent to the 
controlling port is echoed to the other port 
(noncontrolling port). 

Only send data from the ES 1800 to the 
controlling port 

Default: OFF 



Comments 



This provides a way to make a hard copy of emulation data. It is also useful for 
monitoring computer control commands. 

See Serial Communications, page 5-30, for more information on the terminal and 
computer ports. 
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DISABLE BUS ERRORS ON PEEKS/POKES 



Command Result 



ONDBP 



OFF DBP 



When DBP is ON, the bus error signals 
coming from a target system are ignored 
by the ES 1800 during peeks/pokes. 
However, the ES 1800 will still generate a 
bus error when one is detected by the ES 
1800's built-in watchdog circuit 

When DBP is off, target system bus errors 
are detected and will display on your 
console screen. 

Default: OFF 



Comments 



Use this software switch to disable bus errors generated by the target if using overlay 
memory mapped to a target area that will generate bus errors when accessed. 



5-17 



EXTERNAL CYCLE START (68020) 



Command Result 



ON ECS 



OFF ECS 



When ECS is ON, the ES 1800 sends 
both the external cycle start (ECS) and 
the operand cycle start (OCS) signals to 
the target system while in pause mode. 

When ECS is OFF, the ES 1800 does not 
send the external cycle start (ECS) or the 
operand cycle start (OCS) signal to the 
target system while in pause mode. 

Default: ON 



Comments 

This software switch setting is operable only on the 68020 microprocessor. 
The ECS and OCS signals will always be sent to the target during run mode. 
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INTERRUPT ENABLE 



Command 



Result 



ON SLO 



ON FST 



When SLO (slow interrupt enable) is ON, 
interrupts will not be enabled immediately 
upon going into run mode. A delay of 
approximately 160 clock cycles will 
elapse before interrupts are enabled. 

Default: ON 

When FST (fast interrupt enable) is ON, 
interrupts will be enabled the moment the 
ES 1800 begins executing the target 
system program. 

Default: OFF 



Comments 



The FST switch will take precedence over the SLO switch when both are in the ON 
switch setting. 
Switch setting matrix: 



SLO 


FST 


RESULTS 


ON 


ON 


Interrupts immediately enabled 


ON 


OFF 


Interrupts delayed 


OFF 


ON 


Interrupts immediately enabled 


OFF 


OFF 


Interrupts generated by the target 






system will be inhibited from 






reaching the ES 1800. 
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FAST TIME OUT 



Command Result 



ONFTO When FTO is on, BTE requires 2240 

clock cycles. 

OFF FTO When FTO is off, BTE requires 35,840 

clock cycles. 

Default: OFF 



Comments 



FTO should be set appropriately for the target system's bus error timeout. 
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INTROSPECTIVE MODE 



Command Result 



ON IM When IM is ON, the ES 1800 recognizes 

its own internal memory space as a target 
system. This allows the DNL command to 
download to this internal memory space 
just as it would a target system. 

OFF IM The ES 1800 recognizes the pod assembly 

and target microprocessor connected to its 
emulation board as the target system. 

Default: OFF 



Comments 



This command is valid only in pause mode. 
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PEEK POKE TRACE 



Command Result 



ON PPT 



OFF PPT 



This will cause the system while in the 
pause mode to trace all target read (peek), 
and write (poke) cycles to the target 
system. 

In this software switch position, trace 
memory will only trace memory cycles in 
the target system while in run mode or 
while single-stepping. Peeks and pokes, 
while in the pause emulation mode, are 
not traced. 

Default: OFF 



Examples 



To trace peeks and pokes to a particular memory location: 



ON PPT 
AC1 = 5550 

CES; WHEN AC1 THEN TRC 
ITR 

SF 1, 5000 to 5FFF 



All peeks, pokes and memory cycles at the specified memory location will be traced 
by trace memory. To display what has happened at this location (5550) during the 
memory diagnostics, use the DRT command. 
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VIEW BUS SPEED INFORMATION 



Command 



Result 



ONSPD 



When SPD is ON, the IPL column will 
display a number that relates to the access 
time of devices on the target system bus. 



OFF SPD 



When SPD is OFF, the state of the 
interrupt lines will be displayed. 



Default: OFF 



Comments 



Use this software switch setting to view bus timing information instead of the state of 
the interrupt lines (IPL) from the target system. 

The DRT command contains a column labeled IPL that displays the state of the 
interrupt lines from the target system. 

If the SPD switch is ON, this column is labeled SPD. 

If one access displays a 4 and another a 5, the later bus cycle took one more clock 
cycle to complete than the former. Access times greater than or equal to 10 cycles 
display as +. 

The IPL/SPD column is not displayed when in trace mode 2 (68020 only). 
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TRI-STATE ADDRESS BUS 



ON TAD When TAD is ON, the ES 1800 address 

bus is tri-stated while paused. This will 
tri-state the address bus any time the ES 
1800 is not emulating and doing peeks and 
pokes. 

OFF TAD When TAD is OFF, addresses generated 

during pause mode are output by the ES 
1800 address bus to the target system. 

Default: OFF 
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DYNAMIC TRACE CAPTURE ENABLE 



Command 



Result 



ONTCE 



This command enables trace acquisition. 
This is the default (power-up) setting. 



OFF TCE 



This command stops trace acquisition to 
allow examination of your trace memory. 
With TCE off, you can observe trace 
without stopping emulation. 



Comments 



This command is only available with the dynamic trace feature. Operation of the 
dynamic trace feature during run mode requires three steps: 

1. Stop trace acquisition using OFF TCE. 

2. Examine the trace. All trace-related commands are legal while in RUN mode 
with TCE OFF. This includes CUT*, STA*, STD*, STS*, DST*, DRT, DT, 
DTB, DTF, TIM* (* commands for 68020 only). 

3. Restart trace acquisition using ON TCE. The event system compiler is invoked 
when TCE is switched from OFF to ON during RUN mode. New events, 
changes to comparator values, and any changes to the event system are put into 
effect when trace is enabled again, without leaving RUN mode. 

While the OFF TCE command is in effect, the entire Event Monitor System is 
disabled. If an Event Monitor System condition is reached, the system will not 
recognize it or take the appropriate action. Also, the Event Monitor System counters 
will not increment. 

You can toggle the TCE switch while in run mode so you can alternate between using 
the Event Monitor System and reading trace while running. 
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DYNAMIC TRACE CAPTURE ENABLE (cont.) 

SAVE SYSTEM VARIABLES IN EEPROM 



Command 



Result 



SAV 



Copy all system variables from ES 1800 
memory into EEPROM. 



SAV <category> 



Save one of the six categories of variables 
from ES 1800 RAM to EEPROM. 



Comments 

This command is valid only in pause mode. 
A SAV operation may take up to two minutes. 
DO NOT INTERRUPT THE PROCESS! 

Values saved to EEPROM continue to be valid within the ES 1800. 

There is room in EEPROM to save the system variables for two different users. The 
user is determined by a parameter in the SET menu. When you execute a SAV, the 
variables are saved to the user partition currently defined in the SET menu. 
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SAVE SYSTEM VARIABLES IN EEPROM, (cont.) 



This chart shows the categories of information that can be saved in EEPROM and the 
corresponding page numbers to find more information. 



0 


- SET menu 


5-3 


1 


- Contents of ES 1800 registers 


5-68 


2 


- Event Monitor System 


7-1, 8-1 




WHEN/ THEN Statements 




3 


- Overlay map 


5-52 


4 


- Software switch settings 


5-10 


5 


- Macros 


5-116 



Variables are loaded from EEPROM back to the ES 1800 using the LD command. 

Under the following conditions you should execute a SAV command with no 
parameters for both users: 

• when you first receive your ES 1800 

• when you receive an updated version 

• when changing from one microprocessor to another. 

This initializes EEPROM, so that subsequent LD commands will work properly with 
the 68000 series ES 1800 board and pod. 



Examples 



>SAV 1 

The current values of all the ES 1800 registers are saved in EEPROM. 
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LOAD SYSTEM VARIABLES FROM EEPROM 



Command 



Result 



LD 



Copy all system variables stored in 
EEPROM into ES 1800 memory. 



LD <category> 



Copy the variables from one of the six 
categories in the EEPROM to the emulator 
RAM. 



Comments 



This command valid only in pause mode. 

Executing a LD command reads system variables from the EEPROM and copies 
them to into internal RAM. The EEPROM retains those original variables until 
replaced by a SAV command. 

There is room in the EEPROM to load the system variables for two different users. 
The user is determined by a parameter in the SET menu. 

CAUTION: Before executing a LD command, make sure the EEPROM variables are 
compatible with the version and microprocessor you are using. See SAV command 
on page 5-26. 



5-28 



LOAD SYSTEM VARIABLES FROM EEPROM, (cont.) 



You may load the following variable categories from EEPROM: 



0 


- SET menu 


1 


- Contents of ES 1800 registers 


2 


- Event Monitor System WHEN /THEN statements 


3 


- Overlay map 


4 


- Software switch settings 


5 


- Macros 



Examples 



>LD 3 



The overlay memory map in the EEPROM is copied into internal RAM. Use the DM 
command to verify the new map. 
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Serial Communications 

The ES 1800 can communicate through both DB-25 connectors on the chassis rear 
panel using standard RS232C serial protocol. The ports can be independently 
configured for baud rate, data length, and number of stop bits. 

Using A Host Computer 

The most common development configuration is with a terminal connected to the 
terminal port of the ES 1800 and a host development system connected to the 
computer port. The ES 1800 provides a transparent mode that essentially connects 
your terminal to the computer. The ES 1800 also has a special download command to 
load modules from the host system. 

In configurations where the ES 1800 is connected directly to a host computer, there 
are a few details that need to be considered. 

Data Buffering and Baud Rate 

When downloading from a computer, the ES 1800 buffers all the data bytes until the 
end of record. If the checksum is correct, the data are then loaded into target 
memory. During this load time, the host computer may start sending the next data 
record. The serial data buffer in the ES 1800 is 64 bytes deep. When the sixth 
character is placed in the buffer, an XOFF character is sent to the host computer. This 
means that the host computer must transmit no more than 58 characters after the 
XOFF. Some multi-tasking development systems may not be capable of quickly 
stopping character transmission. For these systems, it may be advisable to lower the 
computer port and host computer's baud rates. 

XON and XOFF characters can be used to control either output port on the ES 1800. 
These characters are user definable. The problem described in the above paragraph 
can happen in the reverse direction. If the ES 1800 is uploading data to the host, it 
may be able to overrun the host's ability to receive characters. While lowering baud 
rates may help, there are probably commands available on your host to solve the 
problem. You should also make sure that the host does not echo characters sent to it 
while uploading data. If the characters are echoed, the ES 1800 will quickly send an 
XOFF to the host while continuing to send normal upload characters. The host 
system will then probably send an XOFF to the ES 1800 because the host's buffers 
are full. The result of this situation is that both systems will lock up waiting for the 
other to send an XON. See your system administrator or call Applied Microsystems 
Corporation Customer Service at 1-800-426-3925 for help. 
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System Commands 



Communication with the Host Computer 

While in transparent mode, the ES 1800 passes characters between the computer and 
terminal ports. There is a user definable two-character escape sequence to exit 
transparent mode. If the first character of the escape sequence arrives at either port, 
the ES 1800 'holds' it until it receives another character from the same port. If the 
second character matches the second character of the escape sequence, transparent 
mode is terminated. If the second character is not part of the escape sequence, then 
both the character being 'held' and this second character are sent to the proper port. 
See page 5-3 for setting the escape character sequence. 

While in transparent mode, the only characters that are meaningful to the ES 1800 
are XON, XOFF, the first character of the escape sequence, and the reset character. 
The reset character may be sent from the host as part of a command sequence to the 
terminal. This is common during edit sessions and depends on the command set of 
your terminal. You should define the reset character to be a character that will not 
normally be used by the host system. 

Port Dependent Commands 

Most commands are symmetric with respect to the controlling port and appear to 
respond in the same manner if entered from either the computer port or the terminal 
port. The controlling port is determined at power-up by the setting of the rotary 
switch on the controller board (see page 3-5). After power-up, the commands CCT 
and TCT switch control from one port to the other. TCT entered to the terminal port 
acts like a null command as does CCT entered at the computer port. 

Entering transparent mode from either port causes both ports to be 'connected' to 
each other. If transparent mode is terminated from either port, control returns to the 
port that initiated the transparent mode (TRA) command. 

Download from Terminal Port 

When the ES 1800 receives a download command (DNL), it always expects data 
records to arrive at the computer port. If the download command is entered from the 
terminal port, the ES 1800 automatically enters transparent mode to allow you to 
send commands to your host system. You normally enter a command that causes 
your host system to copy the formatted object file to your terminal (see page 5-8 for 
object file formats). The proper procedure is to enter the command to your host 
system but not terminate it (i.e., do not press the <return> key). Instead, enter the 
two-character transparent mode escape sequence. When transparent mode terminates, 
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control returns to the download process. The download routine then sends the user 
definable command terminator sequence to your host system (see page 5-3). Your 
host system responds by sending the data records from your formatted object file. 
Any characters sent by the computer are echoed to the terminal port. All valid data 
records are copied into internal buffers and the data are written into target memory. 
When the End of File (EOF) record is received, the download process terminates and 
a normal ESL prompt is displayed. 

If an error occurs (checksum or read-after-write) during the download, the process 
terminates with an error and a new prompt is displayed. No special characters are 
sent to the host, however, so it is likely that the next time you enter transparent mode, 
the host will send the remainder of the download data records. 

Download from Computer Port 

If the download command is entered from the computer port, the process is different 
In this case, the ES 1800 does not enter transparent mode. The DNL command can 
be immediately followed by data records. Each data record is acknowledged with an 
ACK (6) character if its checksum is correct and correctly written into target memory 
(verified with read-after-write cycles). The EOF record is also acknowledged if 
valid. If an error occurs during a download, the first character sent back to the host 
will be the BEL (7) code. Programs written on your host system can use these two 
characters to handshake the data records in an automatic download routine. 
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TRANSPARENT MODE 



Command 



Result 



TRA 



The system enters transparent mode. 



ESC ESC 



Port control is returned to the previous 
settings. Note that this escape sequence 
can be changed using the SET command 
(page 5-3). 



Comments 



Transparent mode can be entered while in terminal (TCT) or computer control 
(CCT) mode. 

In transparent mode the ES 1800 acts only as an interface between the two serial 
ports. The ES 1800 can buffer up to 64 characters for each port and can operate each 
port at independent baud rates. 

Obviously, there must be devices connected both to the terminal port (such as a 
terminal) and the computer port (host system, line printer) for this command to have 
any meaning. 

Transparent mode is used to communicate with a host computer, or any other 
peripheral you want to attach to a serial port. 

Refer also to Serial Communications (page 5-30). 
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TRANSPARENT MODE (cont.) 



Examples 



>TRA 



Data entered at either port is transmitted directly to the other port. 
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TERMINAL PORT CONTROL 



Command Result 

TCT The terminal port becomes the controlling 

port. 

Comments 

This command, along with the CCT command, allows control to be switched 
between the two serial ports without powering down the ES 1800 emulator. 

Any output generated by a command is directed to the controlling port. The copy 
switch directs output to both serial ports. 

This command is essentially a null command when entered from the terminal port. 
For port selection on power-up refer to page 3-5. 



5-35 



COMPUTER PORT CONTROL 



Command Result 



CCT The computer port becomes the 

controlling port. 



Comments 



This command, along with the TCT command allows control to be switched between 
the two serial ports without powering down the ES 1800 emulator. 

Any output generated by a command is directed to the controlling port. The copy 
switch directs output to both serial ports. 

This command is essentially a null command when entered from the computer port. 

If there is a host attached to the computer port and you type a CCT from a terminal 
connected to the terminal port, the host system takes control of the ES 1800. The host 
system must be able to handle incoming data at high rates. Both hardware and 
software handshakes are supported (see page 3-15). 

The upload and download operations always send/receive data from the computer 
port regardless of which port is the designated controller. 
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COMPUTER PORT CONTROL, (cont.) 



If you execute CCT in error with no terminal or host system connected to the 
computer port 

1. Move the terminal cable to the computer port, enter the TCT command and 
return the cable to the terminal port. 

In most cases this process returns control to the terminal. If not 

2. Turn the ES 1800 off and then on. 

This command can be executed from the computer port For port selection on 
power-up refer to page 3-5. 



5-37 



DOWNLOAD OPERATIONS 



Command Result 



DNL DNL readies the ES 1800 to receive data. 

If in terminal control mode, the ES 1800 
enters a transparent mode automatically, 
allowing direct communication with the 
host system. Other host system commands 
may be executed prior to the download 
operation. 



Comments 



You can choose the destination of the downloaded file: 

1. Target memory 

2. Overlay memory 

If the downloaded data is going to overlay memory, verify that the overlay is mapped 
in the appropriate address range. Make sure that the start address of the file is the 
address to which you expect to download. 

Verify also that the data format of the host system file matches that being used by the 
ES 1800. Refer to SET menu set parameter #26 for verification of ES 1800 format. 
Use transparent mode (TRA) to verify host system format and the address in the file. 
(See page 5-33.) 

You can download files with either the computer port or the terminal port in control. 
That is, the downloading of files can be initiated and controlled either by the user or 
by a host system. There are some differences in procedure depending on which port 
is in control of the downloading process. 
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DOWNLOAD OPERATIONS, (cont.) 



Downloading Under TERMINAL Port Control 

After typing DNL, the system automatically enters transparent mode, allowing 
communication with the host system. When you are ready to download the file, enter 
a command that causes the host system to display a file to the terminal, but in place 
of a <return> , enter the transparent mode escape sequence (see page 5-33). 

The ES 1800 is now ready to read the data records the host system will be sending. 
Data records are displayed as they are received by the ES 1800. Checksums are 
verified and if a checksum error occurs, the download is aborted with an error 
message. The data in the erroneous record will not have been written to memory. 

Each data byte is verified with a 'read after write' cycle. If an error is detected, the 
download is aborted. 

Return Control to ES 1800 

Once the download command (DNL) is entered, control is returned to the emulator in 
one of three ways: 

1. An end of file record is received. If an end of file record is not recognized by 
the ES 1800, control will not be returned to the emulator terminal port. This 
can be caused by: 

• Using a <return> instead of the proper escape sequence to terminate the 
command line to the host computer. 

• Selecting the incorrect data format. 

2. An ES 1800 reset is executed (factory default is Ctrl z). 

3. An error is detected. 

Downloading Under COMPUTER Port Control 

To download while in computer control with a host computer attached, the host 
computer should send: 

>DNL 



After the host sends the download command, the emulator waits for data at the 
computer port. The host computer should then send the downloadable records 
followed by an end of file record After the end of file record, the system prompt 
( > ) is sent to the computer port. 
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DOWNLOAD OPERATIONS (cont.) 



An acknowledge character (factory default is ASCII ACK $06) will be sent to the 
computer port after storing a data record, when in computer control. No 
acknowledgments are sent when in terminal control. 

There are some differences between computer port control and terminal port control 
during the downloading process. Under computer port control: 

1. All good records are acknowledged with an ACK $06. 

2. All error messages from bad records are received on the computer port; 
therefore the host program that is controlling the ES 1800 will need to be able 
to interpret error messages. 

3. Records are not echoed. 



Symbolic Download 

The download command accepts symbolic definition records as well as data records 
when the symbolic debug option is used and the ES 1800 download format variable 
is set to 5 (Extended Tekhex). (See SET parameter #26, page 5-8.) 

Serial data can be verified with memory constants using the VFY command. 



Errors 

CHECKSUM ERROR IN THE DATA RECORD 

The download process is aborted because the checksum sent with a record file is not 
the same as the checksum calculated by the ES 1800. 
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DOWNLOAD OPERATIONS, (cont.) 



READ AFTER WRITE VERIFY ERROR 

Every byte in a data record is verified after it is stored. This error indicates that the 
data in memory does not match the data that was stored. 



Prnhlpm 


What to Check 


Emulator does not return a prompt 


1. Serial data format - 


after file has been sent. 


SET menu 




2. No end of file (EOF) record. 




3. You entered a <return> 




instead of the transparent 




mode escape sequence after 




entering the host copy command 


Read-after-write verify error. 


1. Target hardware problem. 




2. Overlay memory not 




mapped in download range. 








misverify message. 


Checksum error. 


1. Improperly formatted 




record sent by host 




2. Noisy serial data lines. 




3. Host computer is not 




responding to 




XON/XOFF protocol. 


Display of data does not 


1. Host not responding to 


commence after entering 


user defined command 


transparent mode escape 


terminator sequence - 


sequence 


SET menu 




(page 5-3). 



If the ES 1800 does not return a prompt, you will need to reset the system (default is 
CTRL Z) in order to enter any other ES 1800 commands. 

If the host computer does not respond to the XON/XOFF protocol fast enough, you 
may need to lower the baud rate on the computer port and the host computer. 
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VERIFY SERIAL DATA 



Command Result 



VFY 



Verify serial data with data in memory. If 
the data in memory do not match the 
incoming serial data, this message is 
displayed: 

ADDRESS = XX NOT YY 

'Address' is the address where the data 
mismatch occurred. 'XX' denotes the 
actual data present at that location. 'YY' 
is the serial data just sent. 



Comments 



This command is similar to the download command but no data is written to memory, 
and the serial data is not displayed on the screen. The serial data is compared to the 
data in target or overlay memory. Mismatches are displayed. 

Use this command if you suspect a file you downloaded was corrupted. If 
downloaded data is being corrupted by your program, you can detect it by mapping 
overlay as RO (read only) (see page 5-55). 

This command is also useful for determining differences between object files. Follow 
instructions for downloading a file on page 5-38. 
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UPLOAD SERIAL DATA 



Command Result 



UPL <range> The ES 1800 formats and sends data to the 

computer port. 



Comments 



Data is transferred from the ES 1800 to a host system or other peripheral interfaced 
to the ES 1800 computer port. 

If uploading to a file on a host system, transparent mode should be entered first in 
order to open a file to store the uploaded data records. (Refer to your host system 
instructions on ASCII files.) 

After this is done, enter the transparent mode escape sequence, and the upload 
command. 

After all data has been uploaded and the ES 1800 prompt is returned, enter 
transparent mode and close the file by entering the appropriate control character. 

Remember to close the file before trying to view it 

If your host system does not respond to XON/XOFF protocol, it may be necessary to 
lower the communicating port's baud rates so that the host's input buffer is not 
overrun. 

Upload performs no data verification. 

A file may be uploaded to a printer, PROM programmer or other peripheral instead of 
a host In this case, there is no need to enter transparent mode before uploading. Just 
be sure the peripheral is ready to receive data. 

Refer also to Serial Communications, page 5-30. 



5-43 



UPLOAD SYMBOLS 



Command Result 



UPS 



All currently denned symbols and sections 
are sent to the computer port in Extended 
Tekhex format. 



Comments 



Extended Tekhex restricts the number and range of characters that can be used for 
symbol names. When formating symbols for upload, the ES 1800 truncates symbol 
names to 16 characters and substitutes % for characters not allowed by Tekhex. 

Extended Tekhex serial data format should be set before uploading symbols. (SET 
#26,5) 

If uploading to a file on a host system, transparent mode should be entered first in 
order to open a file to store the uploaded data records. (Refer to your host system 
instructions on ASCII files.) 

After this is done, key in the transparent escape sequence, and begin the uploading. 

After all data has been uploaded and the ES 1800 prompt is returned, enter 
transparent mode and close the file by entering the appropriate control character. 

Remember to close the file before trying to view it 

Refer also to Serial Communications, page 5-30, and Symbols, page 5-125. 
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UPLOAD SYMBOLS, (cont.) 



Examples 

For UNIX: 

Cat ><filename> 

For VMS: 

COPY TT: <filename> 
or 

TYPE SYS$INPUT / OUTPUT = <filename> 

(Create or EDT are also acceptable.) 
For CPM: 

PIP A:<filename> = RDR: 

Next, type the transparent escape sequence and begin uploading. 

After all data has been uploaded and the ES 1800 prompt returns, enter transparent 
mode and close the file by entering the appropriate control character. 

Remember to close the file before trying to view it 
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COMMUNICATION WITH TARGET PROGRAMS 



Command Result 



COM <address> 



Establishes communication with target 
program through two byte pseudo-port at 
the specified address. 

Exit COM mode by entering the two 
character transparent mode escape 
sequence (see SET, page 5-3). 



Comments 



This command is only useful during run mode. It affects real time operation and 
requires special target code. COM mode uses two bytes at the specified address. The 
byte at <address> is used for characters sent from the target to the controlling port. 
The byte at <address> + 1 is used for characters being sent to the target program. 
This command makes use of 7 bit ASCII characters, with the eighth bit of each byte 
used for handshaking. 

To transmit a character to the ES 1800, the target program first checks the most 
significant bit (MSB) of the byte at <address>. If this bit is set (1), the ES 1800 has 
not yet collected the previous character. If the bit is cleared, the target program sets 
the MSB of the character to be transmitted and places the result in the byte at 
<address>. 

To receive a character from the ES 1800, the target examines the byte at <address> + 
1. If the MSB of this byte is cleared, the ES 1800 has not yet transmitted a new 
character. If the MSB is set, the character is new. If the controlling port of the 
ES 1800 is a terminal, the target program should echo the character back by 
immediately copying the character into the byte at <address> with the MSB still set. 
The target then program masks the MSB off and stores the result back at <address> 
+ 1. This prevents the target program from re-reading the same character. 
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COMMUNICATION WITH TARGET PROGRAMS, (com.) 



The COM routine does not check the byte at <address> + 1 to see if the target 
program has received it Generally, the target program will be substantially faster 
than the COM routine and will always receive one character before the COM 
routine can transmit the next. 

The COM mode essentially establishes a transparent mode between the running 
target program and the controlling port of the ES 1800. Whenever the ES 1800 reads 
target memory during run mode, it actually stops emu lation for about 100 
microseconds. To avoid significant impact on real time operation, the COM routine 
examines the byte at <address> only once every 0.5 second. When the COM 
routine discovers a new byte from the target program, it reads the byte and clears the 
location. The byte is then sent to the controlling port of the ES 1800. The COM 
routine then immediately returns to examine the byte at <address>. A target output 
routine has approximately 100 microseconds to place another character in the output 
location. If this 100 microsecond window is missed, the display of the subsequent 
character will be delayed for 0.5 second. 

The following flow diagram summarizes the COM process. 
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COMMUNICATION WITH TARGET PROGRAMS (cont.) 



Figure 5-1. Flowchart 



COM Routine Processing 




Clear byte 
at 

< address > 



Clear bit 7 
of byte 



1 




set Escape 




Flag 






Set bit 7 
of key 
character 



Write byte to 
< address +1 > 



Delay 100 

microseconds 



Set bit 7 of 
escape code 



Write byte to 
< address + 1 > 



Delay 100 
microseconds 



display 
character 
on CRT 
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COMMUNICATION WITH TARGET PROGRAMS, (cont.) 



Examples 



One good example of using the COM command is to simulate a serial I/O port when 
debugging code before target hardware is available. The target program is 
downloaded into overlay memory and emulation is entered by using the RUN 
command. The address supplied to the COM command is that of a simulated RS232 
data port Data entered at the terminal is passed to the target program and data 
output by the program appears on the terminal. 



>MAP 0 TO -1 


/* 


Map all available RAM */ 


>DNL 






%cat serial .driver 


/* 


Download program to overlay */ 


(enter transparent mode escape 


sequence) 




>RNV 


/* 


Run program */ 


R>COM 'serial port 


/* 


Use serial data port as COM addr */ 



A note of caution. If a breakpoint or an error is encountered while running the COM 
command, the system will appear to hang up. This is because Emulation has been 
broken, and the target program that receives and transmits characters is no longer 
running. Entering the transparent mode escape sequence will terminate COM mode 
and cause the break or error message to be displayed. 



5-49 



DISPLAY CHARACTER STRING 



Command Result 



DIA <address> Read and display characters from target 

memory starting at the specified address. 
The DIA routine terminates when it reads 
$00 from target memory. 

Affects real time operation when entered 
in run mode. See page 6-1. 



Comments 



DIA is commonly used for test purposes in target systems that have no human 
readable I/O channels. 

When a test routine detects a problem, it can load a register with the address of a null 
terminated error message. The routine then jumps to an address that causes the ES 
1800 to break emulation. The DIA command can then be used to display the error 
message. 

DIA can also be used to check the contents of any null terminated string in memory. 
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DISPLAY CHARACTER STRING, (cont.) 



Examples 



>BYM 




Make sure we' re in byte mode . 


>M 120 




Enter Memory mode at address 120 


$000120 $00 


>48, 65, 6C, 6C, 6F, 0 




$000126 $00 


>X 


Enter a null terminated string and exit 


>DIA 120 




Display string starting at 120 


Hello 






> 







This example sets a breakpoint in your target error routine. When the breakpoint 
occurs, a message pointed at by the DO register is displayed. If the Dl register is 
zero, the process stops. Otherwise, the ES 1800 immediately begins emulation and 
waits for another breakpoint and message. 



>AC1 = 'Error_stop 

>WKE AC1 THE BRK 

>* RBK;WAI;DIA D0;TST = Dl 
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Overlay Memory 

Overlay memory can be used to debug target hardware and software. It can be used 
to create and verify programs before hardware is available, determine whether your 
program is making illegal accesses, and patch target PROM code quickly and easily. 

Overlay memory is available in memory ranges from 32K to 512K. See your 
Applied Microsystems Corporation sales representative for incremental options. 

Overlay can be mapped in segments as small as 2K bytes. Each segment can be 
assigned one of four attributes; target, read/write, read-only or illegal. If memory is 
mapped, it means that you have assigned at least one segment of overlay as 
read/write, read-only or illegal memory. Unmapped memory is assigned the target 
attribute. Memory mapped as target or illegal does not use up overlay memory. 

When a segment of memory is mapped, program accesses in that memory range are 
directed to the overlay instead of the target. The overlay can be further qualified by 
the overlay enable register (OVE). This register indicates whether code, data or all 
accesses in a mapped memory range should be directed to the overlay memory. 

Overlay memory accesses normally occur in real time; no wait states are added by 
the emulator. However, the 68020 emulator may add wait states depending on the 
target clock speed (see page 5-57). 
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Command Result 



DM Display the memory map currently in 

effect. 



Comments 



This command is valid only in pause mode. 



Examples 



Default map at power up (68000/08/10): 



>DM 

MEMORY MAP: 

OVERLAY ENABLED FOR (OVE=) UD+UP+SD+SP, SPEED (OVS)=0 
MAP $000000 TO $FFFFFF : TGT 
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DISPLAY MEMORY MAP (cont.) 
Default map at power up (68020): 



>DM 

MEMORY MAP: 

OVERLAY ENABLED FOR (OVE=) UD+UP+SD+SP, SPEED (OVS)=l, HW=1 

MAP $00000000 TO $FFFFFFFF : TGT 

> 



NOTE: The 68020 25 MHz version has a default OVS value of 0. 

The HW value represents the overlay speed setting set up in the emulator 
hardware. The HW value will match the OVS setting except when OVS 
= 0, in which case the hardware overlay speed will be set to the 
minimum value allowed at the current CPU clock speed. See page 5-67 
for a more complete description of the overlay speed setting. 
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Command Result 



MAP <range> 
MAP <value> 

MAP <rangexattribute> 
MAP <valuexattribute> 



The specified range is mapped and 
assigned the default attribute type, RW. 

A 2K byte block is mapped surrounding 
the specified value. The block is assigned 
the default attribute type, RW. 

The specified range is mapped and 
assigned the specified attribute type. 

A 2K byte block is mapped surrounding 
the specified value. The block is assigned 
the specified attribute. 



Atrributes 



RW Memory mapped with this attribute will respond like normal overlay 
memory. Overlay memory is high speed and may actually run faster 
than target system memory if that memory normally asserts 'wait 
states.' 

RW is the most common attribute and is therefore the default. MAP 
commands that do not specify an attribute will define RW partitions. 

RO Memory mapped as RO acts like read only memory to your target 
program. If your program attempts to write to this memory, the 
ES 1800 will abort run mode and display MEMORY WRITE 
VIOLATION. The contents of RO overlay cannot be altered by a 
running target program. You can always modify memory mapped as 
RO (in pause mode) even though your target program (run mode) 
cannot. 



5-55 



SET MEMORY MAP (cont.) 



The same comments about speed given in the paragraph on RW, apply 
to memory mapped as RO. 

ILG Memory mapped as illegal can be used to mark address ranges that 
should not be accessed by your target program. Any access to an 
address range mapped as ILG will cause the ES 1800 to abort run 
mode and display MEMORY ACCESS VIOLATION. Memory 
mapped as ILG does not use up available overlay memory. 

TGT Accesses in address ranges mapped with this attribute are ignored by 
the ES 1800. Memory that is not explicitly mapped is defaulted to 
TGT. 



Comments 



Overlay memory is mapped in segments of 2K bytes. If you specify an address or a 
range to be mapped as RW or RO, the mapping outline will allocate the minimum 
number of 2K segments that will completely enclosed the address(es) of interest (see 
overlay memory page 5-63). 

There is a distinction between the overlay map and overlay memory. If your system 
has any overlay memory installed (it is an option), you will have a complete overlay 
map and some limited amount of overlay memory. The overlay map covers the 
entire address space (24 bits). The overlay map is used to logically place segments of 
overlay memory anywhere throughout the address space. 

You can save and restore the contents of the overlay map by using the EEPROM 
LD/SAV commands (see pages 5-28 and 5-26). You cannot save the contents of 
overlay memory in EEPROM. 

Mapping The 68020 

Two issues need to be considered when using overlay memory with the 68020 
microprocessor. The first issue concerns addressing. The second issue deals with wait 
states. 

ADDRESSING 

The overlay memory in the ES 1800 emulator is limited to 24 address bits even 
though the 68020 microprocessor uses 32 address bits. 

This limits the acceptable mapable range to 16 megabytes. Overlay memory may be 
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mapped anywhere in the four gigabyte addressable area of the 68020 in 2K 
increments, provided the mapped area is within a 16 megabyte window. If an 
attempt is made to map overlay memory outside of the 16 megabyte window (called 
a segment) the following error will appear: 



ATTEMPT TO CHANGE CURRENT OVERLAY SEGMENT (USE CLM FIRST) 



The CLM (clear memory map) command must be issued prior to mapping outside 
the previously specified address range. (See page 5-62). 



When mapping memory for the 68020, the most significant address byte must be the 
same for every 2K byte segment mapped (except for memory mapped TGT). 



MAP 


$1F000000 


TO 


$1F0007FF 


:RW 


MAP 


$1F100000 


TO 


$1F101FFF 


:ILG 


MAP 


$1F200000 


TO 


$1F2007FF 


:RO 



WAIT STATES: 



The number of wait states inserted on overlay accesses depends on the target clock 
frequency and the OVS (overlay speed) setting (see page 5-67). 

If a 25 MHz version of the 68020 is used, OVS will default to 0. With OVS set to 0, 
the overlay runs with the minimum number of wait states allowed at the current clock 
frequency. In addition, the processor waits for the return of a DSACK from the 
target, as well as an internal DSACK from overlay, before terminating the bus cycle. 
This prevents overlay from running faster than target memory, and/or corrupting or 
shortening target memory or dynamic RAM refresh cycles. OVS = 0 is not available 
with the 16MHz 68020 pod. 
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If you desire a different overlay speed, or if you map overlay to an address range for 
which the target does not return a DSACK, set OVS to a value between 1 and 7. 
With OVS set to a value between 1 and 7, target DSACKs (if any) are ignored, and 
only the overlay DSACK is supplied to the processor. If the OVS value is set to any 
value outside the 1-7 range (0-7 for 25 MHz version), the following error message 
occurs: 



ILLEGAL OVS VALUE... (NOT IN 1-7) * 



* The 25 MHz pod version will display "(NOT IN 0-7)". 



The minimum allowable OVS value depends on the CPU clock speed, and OVS is set 
to the minimum allowable value if you enter a number lower than the minimum. 

If the target clock speed is 8 MHz, 0 wait states are inserted on overlay accesses. For 
higher clock speeds, wait states will generally be inserted. The number of wait states 
inserted during overlay accesses at different clock speeds is typically as follows: 



12.5 MHz 0 wait states on read cycles, 1 wait state on write cycles 

16.67 MHz 1 wait state on read cycles, 2 wait states on write cycles 

20 MHz* 2 wait states on read cycles, 2 wait states on write cycles 

25 MHz* 3 wait states on read cycles, 3 wait states on write cycles 

* 25 MHz pod only. 



To view the actual number of wait states being inserted in target or overlay bus 
cycles, use the SPD switch in the ON/OFF menu (see page 5-23). This will display 
the number of clock cycles per bus cycle in raw trace. Note that a no wait state cycle 
takes 3 clock cycles with the 68020. The emulator must be in a trace mode other 
than trace mode 2 to view the bus speed information. 

The overlay memory is treated by the 68020 as a 16 bit port This could increase 
execution time if overlaying a 32 bit bus. 

As mentioned in the previous section on addressing, overlay can be mapped in 2K 
increments within a single 16 megabyte segment with the 68020. If some overlay is 
mapped, but an access goes to target space, there may be some circumstances where 
extra wait states will be inserted. With the 25MHz version, no additional wait states 
are inserted in target accesses. However, if a 16MHz 68020 pod is used, one or two 
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additional wait states may be inserted on a target access within the segment where 
overlay is mapped. This depends on the target clock speed and whether target 
memory normally operates with wait states inserted. On accesses to a segment 
different from the one containing mapped overlay, no wait states will be added. 



Examples 



Memory from 0 to 7FF is mapped as RW, the target clock speed is 16.67 MHz, and a 
16.67 MHz emulator pod is being used. On accesses to no wait state target memory 
in the bottom 16 megabyte range (800 to 00FFFFFF), one wait state will be inserted 
on reads, and two wait states will be inserted on writes. On accesses to address 
01000000 and above, no wait states will be added. 

Note: With the 25 MHz pod, no wait states will be added to any target accesses. 
GENERAL MAPPING EXAMPLES 



The following command sequence might reflect a common 68000/08/10 mapping. 



Command 


Comments 


>CLM 


Clear map to all : TGT 


>MAP 'ram-start LEN 2000 


Map some RAM to work, with 


>MAP 'rom-start LEN 4000 :RO 


Map ROM 


>MAP $4000 to $DFFF : ILG 


No accesses expected in this range 


>DM 


Display map 


MEMORY MAP: 




OVERLAY ENABLED FOR (OVE=) UD+UP+SD+SP, SPEED (OVS)=0 


VIAP $000000 TO $003FFF :RW 




y[AP $004000 TO $00DFFF :ILG 




tfAP $00E000 TO $00FFFF :RW 




YIAP $010000 TO $FFFFFF : TGT 
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The following command sequence might reflect a common 68020 mapping. 



Command 




Comments 


>CLM 




Clear map to all : TGT 


>MAP 'ram-start LEN 2000 




Map some RAM to work with 


>MAP 'rom-start LEN 4000 :RO 




Map ROM 


>MAP $4000 to $DFFF : ILG 




No accesses expected in this range 


>DM 




Display map 


MEMORY MAP: 






OVERLAY ENABLED FOR (OVE=) 


UD+UP+SD+SP, SPEED (OVS)=l 


MAP $00000000 TO $00003FFF 


:RW 




MAP $00004000 TO $0000DFFF 


:ILG 




MAP $0000E000 TO $0000FFFF 


:RW 




MAP $00010000 TO $FFFFFFFF 


: TGT 





Since the contents of overlay memory are not affected by changing the overlay map, 
you can compare the operation of a program in your target memory with one in 
overlay memory. 



Command 


Comments 


>CLM 


Clear any previous mapping: 


>MAP 1000 to 7FFF :RO 


Map ROM over existing target program 


>LOV 1000 to 7FFF 


Copy target program into Overlay Memory 


>ASM 2000 


Use line assembler to make a patch 


(Assembler commands) 




>RNV 


Run patched version 


>STP;CLM;RNV 


Stop, Remove Map, Run normal version 


>STP;MAP 1000 to 7FFF :RO;RNV 


Stop, Restore Map, Run patched version 
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If you don't have target memory to work with, and you still want to compare two 
programs, you can use a special method of overlay memory allocation. This 
particular example assumes you have 128K or more of overlay memory. 



-ommand 




Comments 


>CLM 




Clear previous map 


>GR0 = 1000 LEN 8000 




Will save some typing 


>MAP GR0 




Map 32K bytes for code space 


>DNL 




Download first program into overlay 


(Download commands and 


records) 




>MAP GR0 : TGT 




Unmap code space (The data is still 
in Overlay RAM) 


>MAP GR0 + 10000 




Remap but at higher address range. 
The first program now "exists" again 
but in a higher address range. 


>MAP GR0 




Now map more overlay at the normal 
range 


>DNL 




Download second program. 


(Download commands and 


records) 


Now you have a copy of both programs. 


>MAP GR0 : TGT; MAP GRO + 


20000 


Relocates second program out of the way 


>MAP GRO +10000 :TGT;MAP 


GRO 


Relocates first program back to normal 
address range. 
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Command Result 

CLM The entire address range is assigned the 

TGT attribute. 

Comments 

This command clears all addresses from the overlay map. 
This command is valid only in pause mode. 
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Command Result 



OVE = SP + SD Both supervisor program and supervisor 

data space are decoded by the overlay 
memory. 

OVE = SP Only supervisor program status space 

accesses are decoded by overlay memory. 

OVE = SD Only supervisor data status space accesses 

are decoded by overlay memory. 

OVE = ALL Enables overlay for all spaces. 

68000/08: spaces 1, 2, 5, 6, 7 
68010/20: spaces 0-7 

OVE = SC<03,4> Enables overlay memory for a specific 

space (0, 3, 4) as additional memory space 
(68010/20). 
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Comments 



This command allows you to utilize overlay memory as SP, SD, UP, UD, CPU and 
ALL. 



Status 


Mnemonic 


Description 


Space 






0 




Unnamed (68010/20) 


1 


UD 


User data 


2 


UP 


User program 


3 




Unnamed (68010/20) 


4 




Unnamed (68010/20) 


5 


SD 


Supervisor data 


6 


SP 


Supervisor program 


7 


CPU 


Target microprocessor space 



Overlay memory will respond to an access only if a mapped address and the current 
OVE status match the cycle being executed. For more information about the eight 
status spaces, see the Raw Trace section and the 76 Bit Microprocessor Users 
Manual or the MC68020 32 Bit Microprocessor Users Manual. 

SP is code space. The processor encodes it as supervisor program status. 

SD is data space. The processor encodes it as supervisor data. 

Overlay memory cannot be divided between SP and SD on the same map. It is either 
all one (SP), or the other (SD), or all both (SP+SD). 

To display the value of the current status being used for memory mode access, use the 
MMS command (page 5-79). 
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Command Result 



LOV <range> 



Comments 



This command valid only in pause mode. 



Move data from the target system memory 
to the ES 1800 overlay memory in the 
specified address range. 



In order to load overlay memory from the target memory, you must have a target 
system interfaced with the ES 1800 emulator and have overlay memory installed and 
mapped. 

In order to load a target memory range into the overlay memory at a different address, 
use the LOV command, then do a block move (BMO) of the range. If overlay is not 
mapped over the target memory range of interest, the BMO command is all that is 
needed. 

Use the VFO command (page 5-66) to verify the memory move. 



5-65 



VERIFY OVERLAY MEMORY 



Command 



Result 



VFO <range> 



Compare the specified range in the target 
memory to the same range in the overlay 
memory. 

If there are no differences between the 
data in the overlay and target, the 
emulator prompts you for the next 
command. 

If there are any differences, the address of 
each difference displays: 

<ADDRESS> = XX NOT YY 

'XX' denotes the data present in overlay 
memory. 'YY' is the data at that location 
in the target system memory. 



Comments 



This command is valid only in pause mode. 
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Command Result 



OVS = <0-7> Overlay memory will either supply a 

DTACK (DS ACK) or not, according to the 
specified parameter. 



Comments 



Use this register to determine whether overlay memory will return a DTACK to the 
CPU. 

The current value of OVS is displayed when the memory map is displayed. 
OVS may be loaded with one of seven parameters: 



0 


= DTACK (DSACK) supplied by target memory* 


1 


= No delay, address strobe returned to 680XX as DTACK (DSACK) 


2 


= +1 cycle delay 


3 


= +2 cycles delay 


4 


= +3 cycles delay 


5 


= + 4 cycles delay 


6 


= +5 cycles delay 


7 


= +6 cycles delay 



* Note: OVS = 0 is not valid for the 68020 except with the 25 MHz version. For 
the 25 MHz 68020, OVS = 0 causes the CPU to wait for a DSACK from both the 
overlay memory and the target before terminating the bus cycle. This is the default 
setting. 



When overlaying target PROM, you may need to set MMS = <space code> + OVO. 
(OVO is explained on page 5-79.) A DTACK is automatically supplied when this 
command is in effect. When loading or modifying overlay memory, the MMS 
command prevents bus cycles from going to the target, which may be necessary if the 
target generates an error on writes to PROM space. 
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Registers 

The following is a complete list of all the registers in the ES 1800. These registers 
can be logically divided into four groups. Please note that there are separate lists of 
registers for the 68000/08, 68010, and 68020 microprocessors. 

1. microprocessor registers 

2. general ES 1800 registers 

3. event system registers 

4. bus error registers 

Each register accepts one or two of three value types: 

1. integer values 

2. range values 

3 . don' t care values 

Registers that accept range and don't care types can also be assigned integer values. 



68000/08/10/20 Target Microprocessor Registers 



Name 


Description 


Type 


Length (bits) 


PC 


program counter register 


Int 


24 


USP 


user stack pointer register 


Int 


24 


SSP 


supervisor stack 


pointer register 


Int 


24 


SR 


status register 




Int 


10 


AO 


address register 


#0 


Int 


32, 16 


Al 


address register 


#1 


Int 


32, 16 


A2 


address register 


#2 


Int 


32, 16 


A3 


address register 


#3 


Int 


32,16 


A4 


address register 


#4 


Int 


32, 16 


A5 


address register 


#5 


Int 


32,16 


A6 


address register 


#6 


Int 


32, 16 


DO 


data register #0 




Int 


32,16,8 


Dl 


data register #1 




Int 


32,16,8 


D2 


data register #2 




Int 


32, 16, 8 


D3 


data register #3 




Int 


32, 16, 8 


D4 


data register #4 




Int 


32, 16, 8 


D5 


data register #5 




Int 


32, 16, 8 


D6 


data register #6 




Int 


32, 16, 8 


D7 


data register #7 




Int 


32, 16, 8 
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Additional 68010 Target Microprocessor Registers 



Name 




Description 




Type 


Length (bits) 


VBR 


vector base register 




Int 


24 


SFC 


source function code register 




Int 


3 


DFC 


destination function code register 


Int 


3 


Additional 68020 Target Microprocessor Registers 


Name 




Description 




Type 


Length (bits) 


CACR 




cache control 




Int 


32 


CAAR 




cache address 




Int 


32 


MSP 




master stack pointer 




Int 


32 


ISP 




interrupt stack pointer 




Int 


32 


PC 




program counter 




Int 


32 


VBR 




vector base register 




Int 


32 


USP 




user stack pointer 




Int 


32 


General ES 1800 Registers 


Name 




Description 




Type 


Length (bits) 


DFB 




default base 




Int 


8 


GD0-GD7 




general purpose data 




DC 


32 


GR0-GR7 




general purpose range 




Range 


32 


IDX 




repeat index register 




Int 


32 


LIM 




repeat limit register 




Int 


32 


MMP 




memory mode pointer 




Int 


32 


MMS 




memory mode status 




DC 


16 


OVE 




overlay enable 




DC 


8 


TST 




terminator for repeats 




Int 


32 


Event Monitor System Registers 


Name 




Description 




Type 


Length (bits) 


AC1.1-AC1 


4 


address comparator 


Range 


24 


AC2.1-AC2 


4 


address comparator 


Range 


24 


CL.1-CL.4 




count limit comparator 


Int 




16 


DC1.1-DC1 


4 


data comparator 


DC 




16 


DC2.1-DC2 


4 


data comparator 


DC 




16 


LSA.l-LSA 


4 


logic 


state comparator 


DC 


S1.1-S1.4 




status comparator 


DC 




16 


S2.1-S2.4 




status comparator 


DC 




16 


SIA 




special interrupt address 


Int 




32 



Each register has a separate display base. The display base is viewed and changed 
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with the BAS command (see page 5-77). Display bases are often changed for 
registers such as the Event Monitor LSA comparators, which you might like to see in 
binary, and the CL register, which you might want to see in decimal. 

The CPU registers and the Event Monitor registers can be displayed as a group by 
using the DR and DES n commands. 

See Event Monitor System (Chapter 7 for the 68000/08/10 or Chapter 8 for the 
68020) for Event Monitor System register descriptions. 

The complete register set can be loaded from or saved to EEPROM. Executing a 
SAV or LD will copy all system variables. A SAV 1 or LD 1 will copy only the 
register group. 

68000/08/10 Bus Error Registers 

The ES 1800 can send a bus error to the MPU for two different reasons: 

1. When executing the CYC command, a bus error is forced so the long stack of 
information will be available to the firmware that simulates bus cycles. 

2. When the BTE switch is ON, emulation will be aborted by an internally 
generated bus error if the target system holds the address strobe asserted for a 
sufficient length of time. 

In either case, the entire stack of registers is saved in registers with specific names. 
The registers may be examined and/or modified. 

The registers named MSK and R0 -R14 contain internal information that is not 
documented by Motorola. Modification of any of these registers may result in 
unpredictable operation of the 68010 MPU. 
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Figure 5-2. 68000/08/10 Bus Error Registers 



68000/68008 



68010 



Program Counter High 



Program Counter Low 



Status Register 



Instruction Regsiter 



Access Address High 



Access Address Low 



R/W | l/N | FC~ 



Internal 
Information 
16 Words* 



Status Register 



Program Counter High 



Program Counter Low 



XOOO/Vector Offset 



Special Status Word 



Fault Address High 



Fault Address Low 



Unused 



Data Output Buffer 



Unused 



Data Input Buffer 



Unused 



Instruction Input Buffer 



SR 
PC 
FMT 



Valid after 
any error 
message break 



SSW 


I 


FA 




DOB 




DIB 




IIB 




MSK 




RO f 


Valid only 


R1 I 


After Bus 


R2 ) 


> Error on 


R3 [ 


"CYC" 


R4 


Execution 


R5 




R6 




R7 I 




R8 




R9 




R10 




R11 




R12 




R13 




R14 ' 





* These registers contain internal information that is not 
documented by Motorola. Modification of these registers 
may result in unpredictable operation of the 68010/68020 
MPU. 



5-71 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



68020 Bus Error Registers 

The ES 1800 uses the same bus error stack format internally as the 68020 chip does 
externally in the target sytem when the BTE switch is ON and an internal bus error 
occurs. 

This information is available to the user by keying in the register name. Please refer 
to the tables that follow. 

These registers are internal representations of the conditions listed above and do not 
reflect normal bus error information in the target system. 

The first three registers in both the short and long bus cycle are always available after 
each break in emulation. The remainder are only available when the three conditions 
occur: 

1. the BTE switch is ON 

2. an internal bus error occurs 

3. register name is keyed in 



5-72 



System Commands 



Figure 5-3. 68020 Bus Error Registers 
68020 

Short Bus Cycle 
Fault Stack Frame 



Status Register 

Program Counter High 
Program Counter Low 
FMT/Vector Offset 
Internal Register 1 
Special Status Word 
Instruction Pipe C 
Instruction Pipe B 
Fault Address High 
Fault Address Low 
Internal Register 2 High 
Internal Register 2 Low 
Data Output Buffer 
Data Output Buffer 
Internal Register 3 High 
Internal Register 3 Low 



SR 

\ PC 

BFMT 

IR1 

SSW 

\ IPS 

! FA 

} IR2 
\ DOB 
\ IR3 



68020 

Long Bus Cycle 
Fault Stack Frame 



Status Register 


SR 


Program Counter High 


\ PC 

s 


Program Counter Low 


FMT/Vector Offset 


BFMT 


Internal Register 1 


IR1 


Special Status Word 


SSW 


Instruction Pipe C 


} IPS 


Instruction Pipe B 


Fault Address High 


} FA 


Fault Address Low 


Internal Register 2 High 


} IR2 


Internal Register 2 Low 


Data Output Buffer 


} DOB 


Data Output Buffer 


Internal Register 3 High 


} IR3 


Internal Register 3 Low 


Internal Register 4 High 


J IR4 


Internal Register 4 Low 


Stage B Address High 


\ SBA 


State B Address Low 


Internal Register 5 High 


} IR5 


Internal Register 5 Low 


Data Input Buffer 


J DIB 


Data Input Buffer 


Internal Register 6H 


\ IR6 


Internal Register 6L 


Internal Register 7H 


\ IR7 


Internal Register 7L 


Internal Register 8H 


\ IR8 


Internal Register 8L 


Internal Register 9H 


\ IR9 


Internal Register 9L 


Internal Register 1 0H 


} IRA 


Internal Register 10L 


Internal Register 1 1 H 


} IRB 


Internal Register 11 L 


Internal Register 12H 


\ IRC 


Internal Register 12L 


Internal Register 13H 


\ IRD 


Internal Register 13L 


Internal Register 14H 


\ IRE 


Internal Register 14L 


Internal Register 15H 


J IRF 


Internal Register 15L 


Internal Reqister 1 6H 


\ IRG 


Internal Register 16L 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS 



Command 



Result 



DR 



DR causes the system to display the 
contents of all the microprocessor 
registers. 



CLR 



The CLR command clears registers A0- 
A6 and D0-D7 to zero. 



LDV 



Load the reset vectors into the stack 
pointer and program counter. The reset 
vectors can also be loaded by the RNV 
and RBV commands. These load the 
vectors and enter run mode (page 6-5). 



Comments 



The CLR and LDV commands are valid only in pause mode. 

If DR is keyed in while running, the values will be as they were before entering run 
emulation. They will not accurately reflect current values. 

Refer to the Motorola 16 Bit Microprocessors Users Manual or the MC68020 
Microprocessors Users Manual for the default power-up values of the 
microprocessor registers. Register values may be saved to and loaded from 
EEPROM. 

The CPU registers are automatically copied from ES 1800 RAM to the 
microprocessor when run mode is entered. When emulation is broken, they are 
copied from the processor to ES 1800 RAM. 

If a CPU register is loaded with a value during run mode, a warning message will be 
displayed. This warning informs you that the value you are entering will not be sent 
to the pod CPU during emulation. The value is stored in the ES 1800's internal 
RAM, but when emulation is broken, the new value of the CPU register overwrites 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS, (cont.) 



the value just entered. 

The display of the SR (and CCR in the 68020) register is different from that of the 
other CPU registers. The flags are more conveniently decoded by using an alpha 
character to indicate whether the flag was set or cleared by a particular instruction 
cycle. If the flag is clear, you see a . as a place holder. If set, the following 
characters describe the flag. 



X 


- Trace on execution (SR, 68020) 


O - Overflow 


M, I 


- Master/Interrupt state 




0-7 


- Interrupt priority mask 




T 


- Trace mode 




S, U 


- Supervisor/User state 




Z 


- Zero 




N 


- Negative 




X 


- Extend (CCR) 




c 


- Carry 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS (cont.) 



Examples 



(f 


8000/08 microprocessor) 






-0- -1- - 2 - -3- -4- - 5 - 


- 6 - - 7 - 


D 


= 00000000 00000000 00000000 00000000 00000000 00000000 


00000000 00000000 


A 


= 00000000 00000000 00000000 00000000 00000000 00000000 


00000000 




PC = 000000 SSP = 000000 USP = 0000000 SR 


= TS7XNZVC 



(68010 microprocessor) 

-0- -1- -2- -3- -4- -5- - 6 - - 7 - 
D - 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 
A = 00000000 00000000 00000000 00000000 00000000 00000000 00000000 

PC=000000 VBR=000000 SFC=0 DFC=0 SSP=000000 USP=000000 SR=TS7XNZVC 



(68020 microprocessor) 










- 0 - - 1 - 


- 2 - - 3 - 


- 4 - - 5 - 


- 6 - 


- 7 - 


D = 00000000 00000000 


00000000 00000000 


00000000 00000000 


00000000 


00000000 


A = 00000000 00000000 


00000000 00000000 


00000000 00000000 


00000000 




SR = XSI7 




SFC = 0 


MSP = 


00000000 


CCR = XNZVC 


CAAR = 00000000 


DFC = 0 


ISP = 


00000000 


PC = 00000000 


CACR - 00000000 


VBR = 00000000 


USP = 


00000000 
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SET/DISPLAY REGISTER DEFAULT BASE 



Command Result 



BAS<register> 



BAS <register>= <base value> 



Display the decimal base of the specified 
register. 



#0 


- default 


#2 


- binary 


#8 


- octal 


#10 


- decimal 


#16 


- hexadecimal 



If the register has not been assigned a 
separate display base, the current default 
base is displayed. 

Set the display base of the register to the 
base value. 

If the base value for a register is set to 0, 
the current default base is used for 
display. 



Comments 



Base values may be stored in EEPROM and automatically loaded on power-up or 
manually retrieved using the LD or LD 1 command. 

Be careful when setting private display bases to unusual bases such as 4, 7 or 11. 
The ES 1800 operates correctly, but the results may be confusing. If you set the base 
value to a value other than hexadecimal, decimal, octal, or binary, the ES 1800 
displays a question mark (?) preceding the base value when asked to display the base 
in effect. 
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SET/DISPLAY REGISTER DEFAULT BASE (com.) 

Refer to the default base command, DFB (page 5-83), for displaying the system 
global default base. 



Examples 



>BAS SR 
DEFAULT: #16 
>BAS SR=#8 
>BAS SR 
#8 



>GD3 

$0000AA55 
>BAS GD3 = 2 
>BAS GD3 
#2 

>GD3 

%00000000000000001010101001010101 



The value of GD3 will always be displayed in binary until you change its display 
base or the ES 1800 is powered down. 
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MEMORY MODE STATUS REGISTER 



Command 



Result 



MMS 



Display the value of the current status 
being used for memory accesses (peeks 
and pokes). 



MMS 



<MMS memory space> 



Set the status space for memory accesses. 



MMS = <MMS memory space> + TGO Map overlay memory and examine target 

(with no impact on mapped memory). 

MMS = <MMS memory space> + OVO Map target system and examine overlay 

memory. OVO parameter results in no bus 
cycles entering the target system. 

MMS = <MMS memory space> + NRM Returns system to default mode after TGO 

or OVO has been specified. 

MMD MMD is used like MMS, but for block 



NOTE: TGO (target only), OVO (overlay only), and NRM (normal) are unalterable 
status constants used in the ES 1800 as qualifiers when setting up the MMS or MMD 
register. They set flag bits in these registers for the emulator software. 



verifies and block moves. 
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MEMORY MODE STATUS REGISTER (cont.) 



Comments 



One of eight memory spaces can be selected to operate memory with: 



SCO 




unused (used only by 68010 


and 68020) 


SCI 




UD (user data) 




SC2 




UP (user program) 




SC3 




unused (used only by 68010 


and 68020) 


SC4 




unused (used only by 68010 


and 68020) 


SC5 




SD (supervisor data) 




SC6 




SP (supervisor program) 




SC7 




CPU (interrupt acknowledge 


or CPU space cycle) 
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MEMORY MODE POINTER 



Command 



Result 



MMP 



Display the current value of the memory 
mode pointer. 



MMP = <exp> 



Assign the value <exp> to the memory 
mode pointer. 



Comments 



The MMP is the last address examined while in memory mode. If you enter memory 
mode without specifying an address, the MMP value is used as the entry point. 

This default power-up value of the MMP register is zero. This register may be saved 
to and loaded from EEPROM. 

The memory mode pointer is automatically modified when you scroll to a new 
address after entering memory mode. When you exit memory mode, the MMP 
reflects the last address examined. For more information on memory mode, see page 



6-15. 
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MEMORY MODE POINTER (cont.) 



Examples 



Set an address comparator to the last address examined in memory mode. 



>M 6000 




(examine 


memory until you find a location of interest) 


$006013 5A 


>X 


>AC1=MMP 
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DEFAULT BASE 



Command Result 



DFB Display the global default base. 

On power-up the default base is 
hexadecimal unless another default base 
has been loaded by the EEPROM on 
power-up. 

DFB = #2 Set the default base to binary. 

DFB = #8 Set the default base to octal. 

DFB = #10 Set the default base to decimal. 

DFB = #16 Set the default base to hexadecimal. 



Comments 



Various operators tell the ES 1800 what base an input value is in. They are: 



Operator 


Description 


Example 


<%> 


Binary 


%10011100001111 


<\> 


Octal 


\23417 


<#> 


Decimal 


#9999 


<$> 


Hexadecimal 


$270F 



Base prefixes can be used any time to enter a value in a base different than the default 
base. Values not preceded by one of these prefixes are presumed by the ES 1800 to 
be in the default base. 

For example, if you set the global default base to binary, and you then want to assign 
a value to a register in a base other than binary, use a base prefix. 
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DEFAULT BASE (cont.) 



The ES 1800 works correctly with any base between 2 and 16. However, if you set 
an uncommon base, such as 5 or 9, the results of assignments and commands may be 
confusing. 

If the base is outside the allowable range, an error message is displayed and the ES 
1800 defaults to the hexadecimal base. 
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GENERAL PURPOSE DATA REGISTERS 



Command 



Result 



GD<0-7> 



Display the value of the specified register. 

Assign a value to one of the eight general 
purpose data registers. 



GD<0-7> = <value> 



Comments 



Use the general purpose registers as arguments to commands to save key strokes 
when using values repeatedly. They can also be used to save space in macro 
definitions. 

These general purpose registers may be used in place of integer or don't care values 
in command statements. 

The general purpose data registers can be loaded with any integer or don't care value. 
They will not accept a range value. 
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GENERAL PURPOSE DATA REGISTERS (cont.) 



Examples 



General purpose data register four is loaded with 5000. GD4 can now be used 
anywhere you would use this integer value. 



>GD4 = 5000 



If you are looking for a specific pattern on the LS A pod lines in more than one event 
group, assign a general purpose data register the value you are looking for. All 
subsequent LS A assignments can use this register. 



>GD2 


= %01100101100 DC %10011 




>LSA 


= GD2; LSA.2 = GD2 




>GD3 


= 'datpatl DC $FF00 


Looking for one byte 


>DC1 


= GD3 


of a specified word? 



You may choose to use a general purpose register instead of memory mode status 
mnemonics. 



>GD6 


= SP 




>MMS 


= GD6 




>GD1 


= OVL+RD+IOA 


To set-up a breakpoint on an overlay 


>S1 ■ 


= GDI 


read. 
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GENERAL PURPOSE ADDRESS REGISTERS 



Command 



Result 



GR<0-7> 



Display the value of the specified register. 

Assign a value to one of the eight general 
purpose address registers. 



GR<0-7> = <value> 



Comments 



Use the general purpose registers as arguments to commands to save key strokes 
when using values repeatedly. They can also be used to save space in macro 
definitions. 

These general purpose registers may be used in place of integer or range values in 
command statements. 

The general purpose data registers can be loaded with any integer or range value. 
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GENERAL PURPOSE ADDRESS REGISTERS (cont.) 



Examples 



General purpose address register 4 is loaded with 5000. GR4 can now be used 
wherever you would use this integer value. 



>GR4 = 5000 



Assign a register a range you will be using often. Then use it as a parameter for other 
commands. 



>GR0 = 'start_code LEN 20 
>DIS GR0 
>DB GR0 



If you do not know the absolute address in your target hardware, but have 
downloaded a symbol table containing them, then use the symbol names instead of 
looking up the hardware specifications. 



>GR2 = 'ram LEN ' ram_len 


Initialize GR2 


>SF 0,GR2 


Run a RAM test on your RAM 


>AC1 = GR2 


Set a breakpoint on any RAM access 


>WHE AC1 THE BRK 
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TEST REGISTER 



Command Result 



TST 



The test register is is used to stop 
repeating commands. It is set to an 
expression in a command line. When it 
becomes zero, the repeat halts. 



Comments 



See The Repeat Operator for more detailed information. (See page 5-121). 
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ES 1800 Emulator User's Manual for 68Q00 Series Microprocessors 



Trace Memory 

Trace memory commands deal with the display and disassembly of trace memory 
data. Refer to the Event Monitor System (Section 7 for 68000/08/10 or Section 8 for 
68020) for sophisticated uses of trace memory. 

Trace memory is 70 bits wide and 2046 bus cycles deep (101 bits wide for 68020). 
You may use some bus cycles as marks to identify start and stop points within the 
trace buffer. An unqualified trace contains all bus activity for the last 2046 bus 
cycles. Trace can be searched for a particular address, data or status. 

During emulation, the activity of the executing program is recorded and stored in 
trace memory. All address lines, data lines, processor status lines, and 16 bits of 
external logic-state are traced. This record becomes a history of the program. If 
something unexpected happens during program execution, trace memory can be 
reviewed to determine what happened. When used in conjunction with the trace 
disassembler, hardware and software problems may be found. 

You cannot access trace memory during emulation unless you have the Dynamic 
Trace feature. Therefore, you must stop program execution before reading the trace. 
You can stop the program either manually or by using the Event Monitor System to 
stop at the exact program state you are interested in. After program execution is 
stopped, you may review the address, data and control signals of the most recently 
traced cycles. 

Dynamic Trace (Optional) 

The Dynamic Trace feature of the ES 1800 allows you to read trace while the target 
system is running. You can trace in target systems which require one or more signal 
lines active, such as targets using dynamic RAM. With targets using multiple 
multiprocessors, dynamic trace lets you examine trace from one processor without 
shutting down all the processors. 

Timestamp (68020) 

A timer provides a time signature for each bus cycle captured in trace memory. Each 
line in trace memory is "stamped" with a time relative to when emulation started. 
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System Commands 



Emulation 

Trace Memory Modes (68020) 

The 68020 microprocessor is a 32 bit environment, while the trace and Event 
Monitor Systems are based on a 16 bit environment. The additional signals available 
with the 68020 microprocessor make it impossible to trace all 32 address, 32 data, 
and relevant status bits simultaneously. 

To enhance compatibility of these two environments, the ES 1800 has four trace 
memory modes. These four modes trace four combinations of address, data, and 
status bits giving you full coverage of the bits available with the 68020 
microprocessor. 

The four trace memory modes and their respective bit combinations are: 



Mode 


Address 


Data 


Status 


Timing 


LSA 


0 


24 


16 


19 


24 


16 


1 


24 


32 


19 


24 


0 


2 


32 


32 


11 


24 


0 


3 


32 


16 


21 


24 


6* 



* Note: 6 LSA bits are available in trace mode 3 only with the 16 Mhz pod. The 
25 MHz probe module does not have this feature. 

Mode Selection 

To select the mode that will be most effective, you will need to consider the trade-offs 
of the different trace modes. Consider the width of your target memory (byte, word, 
or long-word), the range of addresses over which your program operates, and the 
status information you will need. Keep in mind that the trace disassembler works 
only in trace mode 2. 

When using the 68020 microprocessor, you must designate one of the four trace 
modes prior to entering run mode. Set parameter #4 on the SET menu (see page 5-5) 
is used to designate the trace mode. Trace mode 2 is the default. 

The event system set up may depend on the trace mode used. (Refer to page 8-24 for 
more detailed information). 
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DISPLAY RAW TRACE BUS CYCLES 



Command Result 



DRT 

DRT <line number> 
DRT <range> 



Display the last page of bus cycles 
recorded in trace memory. 

Displays a page of the trace buffer starting 
with <line number>. 

Display the range of line numbers. XON 
and XOFF may be used to start and stop 
scrolling if the range is larger than the 
console display. 

Note that the range is a range of bus 
cycles, not the address recorded in the 
trace memory. 



Comments 



Set parameter #13 sets the page length. (Refer to page 5-6). 

This command is valid only in pause mode, unless you have the dynamic trace 
feature. 

See the DST command (68020), page 5-107 for another way to display the raw trace 
bus cycles, showing greater timestamp resolution in trace. DST lets you see trace 
information for the DS, SZ, and OCS bits, even in trace modes 0 and 3. 

NOTE: The sequence numbers in DT, DTB, and DTF (instructions) correlate with 
the line numbers displayed in DRT (bus cycles). However, one or more bus cycles in 
the DRT display may make up one instruction on the DT, DTB or DTF displays. 
These displays may have missing sequence numbers indicating a multiple bus cycle 
instruction has been executed. Also, the sequence number (SEQ #) may be repeated 
when two byte wide instructions were executed from continuous addresses. 
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DISPLAY RAW TRACE BUS CYCLES, (cont.) 



Examples 



68000/08/10 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




#20 


00100A 


> 


3080 


R 


OVL 


#19 


00100C 


> 


B03C 


R 


OVL 


#18 


00100E 


> 


0039 


R 


OVL 


#17 


001010 


> 


6C02 


R 


OVL 


#16 


001012 


> 


5E40 


R 


OVL 


#15 


001014 


> 


5740 


R 


OVL 


#14 


001016 


> 


41FA 


R 


OVL 


#13 


001018 


> 


03F0 


R 


OVL 


#12 


00101A 


> 


3140 


R 


OVL 


#11 


00101C 


> 


FFOO 


R 


OVL 


#10 


00101E 


> 


1140 


R 


OVL 


#9 


001308 


> 


0037 


R 


OVL 


#8 


001020 


> 


FFF7 


R 


OVL 


#7 


001022 


> 


60F0 


R 


OVL 


#6 


0013FF 


> 


37 


W 


OVL 


#5 


001024 


> 


4E71 


R 


OVL 


#4 


001004 


> 


B03C 


R 


OVL 


#3 


001006 


> 


0039 


R 


OVL 


#2 


001008 


> 


6C02 


R 


OVL 


#1 


00100A 


> 


3080 


R 


OVL 


#0 


BREAK 











FC 


IPL 


LSA - 8 


7-0 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 


SP 


0 


%11111111 


%11111111 
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DISPLAY RAW TRACE BUS CYCLES (cont.) 



68020 
MODE 0 DISPLAY 



>DRT 














LINE 


ADDRESS 


DATA 


R/W 




FC 


#20 


pnn c if- 
r UUjjL 




51CB 


R 


TAR 


SP 


#19 


r UU J jCi 




FFF8 


R 


TAR 


SP 


#18 


F U UO 4 U 


> 


6024 


R 


TAR 


SP 


#17 


t? n n c; a o 


> 


4A03 


R 


TAR 


SP 


#16 


t UUO Jfi 


> 


007E 


R 


TAR 


SP 


#15 


tp n n R "i c 


> 


301A 


R 


TAR 


SP 


#14 


r UU3 JO 




E309 


R 


TAR 


SP 


#13 


c n n r *5 a 




6506 


R 


TAR 


SP 


#12 


r UUOiiA 




0000 


R 


TAR 


SD 


#11 






51CB 


R 


TAR 


SP 


#10 


F0053E 


> 


FFF8 


R 


TAR 


SP 


#9 


F00540 


> 


6024 


R 


TAR 


SP 


#8 


F00542 


> 


4A03 


R 


TAR 


SP 


#7 


F00534 


> 


007E 


R 


TAR 


SP 


#6 


F00536 


> 


301A 


R 


TAR 


SP 


#5 


F00538 


> 


E309 


R 


TAR 


SP 


#4 


F0053A 


> 


6506 


R 


TAR 


SP 


#3 


F005BC 


> 


0000 


R 


TAR 


SD 


#2 


F0053C 


> 


51CB 


R 


TAR 


SP 


#1 


F0053E 


> 


FFF8 


R 


TAR 


SP 


#0 


BREAK 













IPL 


LSA - 8 


7-0 


TIME 




n 
u 




%11111111 


%11111111 


JU 1 


lio 


MS 


U 




%11111111 


%11111111 


oni 
iU / 


A 1 Q 


MS 


U 




%11111111 


%11111111 


JU 1 




MS 


U 




%11111111 


%11111111 


JU / 


4^U 


MS 


U 




%11111111 


%11111111 


JU / 




MS 


U 




%11111111 


%11111111 


JU / 




MS 


U 




%11111111 


%11111111 


307 


422 


MS 


U 




%11111111 


%11111111 


JU 1 


/ o *a 


MS 


U 




%11111111 


%11111111 


JU / 


AO A 


MS 


0 




%11111111 


%11111111 


307 


424 


MS 


0 




%11111111 


%11111111 


307 


425 


MS 


0 




%11111111 


%11111111 


307 


426 


MS 


0 


IP 


%11111111 


%11111111 


307 


427 


MS 


0 


IP 


%11111111 


%11111111 


307 


.427 


MS 


0 


IP 


%11111111 


%11111111 


307 


.428 


MS 


0 


IP 


%11111111 


%11111111 


307 


.429 


MS 


0 


IP 


%11111111 


%11111111 


307 


.429 


MS 


0 


IP 


%11111111 


%11111111 


307 


.430 


MS 


0 


IP 


%11111111 


%11111111 


307 


.431 


MS 


0 


IP 


%11111111 


%11111111 


305 


.431 


MS 
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DISPLAY RAW TRACE BUS CYCLES, (cont.) 



68020 
MODE 1 DISPLAY 

>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 




DS 


sz 


ocs 


TIME 




-ii o n 
#^U 


F0053C 


> 


0 ICBr ttr 


R 


TAR 


SP 


(J 




01 


0 0 


0 


1 


.396 


s 


tiy 


F0053E 


> 


r r r or r r r 


R 


TAR 


SP 


U 




U 1 


10 


1 


1 


.396 


s 


fflo 


F00540 


> 


oU«£ 4r r r r 


R 


TAR 


SP 


u 




U 1 


uu 


u 


1 


.396 


s 


■tt- 1 *7 
#1 / 


F00542 


> 


A 7\ f\ O TT'TT^TP TT 1 

4AUofc ttr 


R 


TAR 


SP 


u 




U 1 


10 


1 


1 


.396 


s 


ill c 

fib 


F00534 


> 


U U ItLt ftt 


R 


TAR 


SP 


u 




U 1 


UU 


u 


1 


.396 


s 


11 c 

#1~> 


F00536 


> 


JU lAt 1 1 1 


R 


TAR 


SP 


U 




Ul 


10 


1 


1 


.396 


s 


#14 


F00538 


> 


fl "D n O. T71 TP T7 1 

EjU yFFFt 


R 


TAR 


SP 


A 
U 




0 1 


00 


0 


1 


.396 


s 


#1 J 


F0053A 


> 


bo U or 1 1 1 


R 


TAR 


SP 


u 




U 1 


1U 


-1 

1 


1 


.396 


s 


11 o 

ffl^ 


F005B4 


> 


U Uh At 1 1 1 


R 


TAR 


SD 


U 




U 1 


1U 


u 


1 


.396 


s 


til 


r UUO JC 


> 


3 ICBr ttt 


R 


TAR 


SP 


U 




U 1 


0 0 


A 

u 


1 


1 Q C 

. j y o 


s 


#10 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


.396 


s 


#9 


F00540 


> 


6024FFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


.396 


s 


#8 


F00542 


> 


4A03FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


.396 


s 


#7 


F00534 


> 


007EFFFF 


R 


TAR 


s? 


0 


IP 


01 


00 


0 


1 


.396 


s 


#6 


F00536 


> 


301AFFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 


#5 


F00538 


> 


E30 9FFFF 


R 


TAR 


SP 


0 


IP 


01 


00 


0 


1 


.396 


s 


#4 


F0053A 


> 


650 6FFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 


#3 


F005B6 


> 


005 6FFFF 


R 


TAR 


SD 


0 


IP 


01 


10 


0 


1 


.396 


s 


#2 


F0053C 


> 


5 1CBFFFF 


R 


TAR 


SP 


0 


IP 


01 


00 


0 


1 


.396 


s 


#1 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 



#0 BREAK 



5-95 



DISPLAY RAW TRACE BUS CYCLES (cont.) 



68020 
MODE 2 DISPLAY 

>DRT 



LINE 


ADDRESS 




DATA 


R/W 




FC 


DS 


sz 


ocs 


TIME 




#20 


FFF00506 


> 


00C0FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 


#19 


FFF00508 


> 


20 6DFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#18 


FFF0050A 


> 


041AFFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 


#17 


FFF21C72 


< 


FFFBFFFB 


W 


TAR 


SD 


01 


00 


0 


1 


.215 


s 


#16 


FFF21C74 


< 


00400040 


W 


TAR 


SD 


01 


10 


1 


1 


.215 


s 


#15 


FFF21C6E 


< 


FFF2FFF2 


w 


TAR 


SD 


01 


00 


0 


1 


.215 


s 


#14 


FFF21C70 


< 


04220422 


w 


TAR 


SD 


01 


10 


1 


1 


.215 


s 


#13 


FFF0050C 


> 


22 68FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#12 


FFF0050E 


> 


000CFFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 


#11 


FFF2041A 


> 


FFF2FFFF 


R 


TAR 


SD 


01 


00 


0 


1 


. 215 


s 


#10 


FFF2041C 


> 


0422FFFF 


R 


TAR 


SD 


01 


10 


1 


1 


.215 


s 


#9 


FFF00510 


> 


4A2 9FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#8 


FFF00512 


> 


0007FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 


#7 


FFF2042E 


> 


FFFBFFFF 


R 


TAR 


SD 


01 


00 


0 


1 


.215 


s 


#6 


FFF20430 


> 


0040FFFF 


R 


TAR 


SD 


01 


10 


1 


1 


.215 


s 


#5 


FFF00514 


> 


6A02FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#4 


FFF00516 


> 


610 6FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 


#3 


FFFB0047 


> 


44FFFFFF 


R 


TAR 


SD 


10 


01 


0 


1 


.215 


s 


#2 


FFF00518 


> 


4CDFFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#1 


FFF0051A 


> 


0300FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 



#0 BREAK 
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DISPLAY RAW TRACE BUS CYCLES, (cont.) 



68020 
MODE 3 DISPLAY 

>DRT 



LINE 


ADDRESS 




DATA 


R/W 




FC 


IPL 




LSA - 0* 


TIME 




#20 


FFF21C5E 


< 


FFFB 


w 


TAR 


SD 


0 


IP 


%111111 


500 


183 


MS 


#19 


FFF21C60 


< 


0040 


w 


TAR 


SD 


0 


IP 


%111111 


500 


184 


MS 


#18 


FFF21C5A 


< 


FFF2 


w 


TAR 


SD 


0 


IP 


%111111 


500 


184 


MS 


#17 


FFF21C5C 


< 


0422 


w 


TAR 


SD 


0 


IP 


%111111 


500 


185 


MS 


#16 


FFF21C56 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


186 


MS 


#15 


FFF21C58 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


186 


MS 


#14 


FFF21C52 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


187 


MS 


#13 


FFF21C54 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


188 


MS 


#12 


FFF21C4E 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


188 


MS 


#11 


FFF21C50 


< 


0008 


w 


TAR 


SD 


0 


IP 


%111111 


500 


189 


MS 


#10 


FFF21C4A 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.190 


MS 


#9 


FFF21C4C 


< 


00FE 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.190 


MS 


#8 


FFF21C4 6 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


191 


MS 


#7 


FFF21C48 


< 


0003 


w 


TAR 


SD 


0 


IP 


%111111 


500 


192 


MS 


#6 


FFF21C42 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


192 


MS 


#5 


FFF21C44 


< 


0003 


w 


TAR 


SD 


0 


IP 


%111111 


500 


193 


MS 


#4 


FFF21C3E 


< 


0014 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.193 


MS 


#3 


FFF21C40 


< 


oooc 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.194 


MS 


#2 


FFF21C3A 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.195 


MS 


#1 


FFF21C3C 


< 


0001 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.195 


MS 



#0 BREAK 



* Note: When a 25 MHz pod is used, the LSA bits do not appear in raw trace in trace 
mode 3. 
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DISPLAY RAW TRACE BUS CYCLES (cont.) 



UNE 



ADDRESS 
DATA 



R/W 

TARIOVL 

RM (68020, Mode 3) 

FC 

V 

B 

BER 



Line number 0 in the trace buffer indicates 
the last bus cycle prefetched or executed 
before the ES 1800 went into pause mode. 
The larger the LINE number the further 
back in the history of the program you are 
viewing. You can get a good idea of the 
relationship of bus cycles to instructions 
by matching the bus cycle LINE numbers 
in the DRT to the SEQ# in the 
disassembled trace. 



The address displayed is where the bus 
cycle took place, along with the DATA 
written to, or read from, that address. 

> and < are data direction indicators. 
They display whether data was read from 
an address (>) or written to an address (<). 
These same indicators are used in the trace 
disassembly. 

Indicates whether the cycle was a read or 
a write. 

TAR/OVL indicates whether the access 
was in the target memory area or in the ES 
1800's overlay memory (see DM 
command to determine what addresses are 
mapped). 

68020 RMC signal. Indicates the cycle 
was an indivisible read-modify-write 
cycle. 

Indicates the state of FC0-2. 

Marks all cycles that occurred after a 
memory write violation or memory access 
violation. 

Marks all bus cycles that occurred after a 
breakpoint. 

Indicates the BERR signal was asserted. 
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DISPLAY RAW TRACE BUS CYCLES, (cont.) 



IPL 

CD (68020, Mode 3) 
AV (68020, Mode 0,1,3) 
IP (68020, Mode 0,U) 
LSA 



DS (68020, Mode 1,2) 

SZ (68020, Mode 1,2) 
OCS (68020, Mode 1,2) 

TIME (68020) 

VM (68000/10) 
VP (68000108110) 



Indicates the interrupt level encoded on 
the IPLO-2 lines. 

Indicates the CDIS signal was asserted. 

Indicates the AVEC signal was asserted. 

Indicates the IPEND signal was asserted. 

LSA columns display the state of each pin 
of the LSA pod during that bus cycle. 

NOTE: The same information that is 
recorded in the trace buffer can be used by 
the Event Monitor System to cause event 
actions. Therefore everything in the trace 
buffer can cause event actions such as 
selective tracing, counting, or breaking 
emulation (refer to the Event Monitor 
System, Section 7 for 68000/08/10 or 
Section 8 for 68020). 

Indicates the state of DSACK0 and 
DSACK1. 

Indicates the state of SIZ0 and SIZ1. 

Indicates whether the OCS signal was 
asserted. 

Indicates the time elapsed since emulation 
was entered. 

Indicates the VMA signal was asserted. 
Indicates the VPA signal was asserted. 
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CLEAR TRACE MEMORY (68020) 



Command Result 



CLT All current trace memory is cleared. 

Applies to 68020 only. 



5-100 



DISASSEMBLE TRACE MEMORY 



Command 



Result 



DT 



Disassemble and display the last 
instruction in trace memory. A sequence 
number is not included. Overwrites 
current display line. 



DT <range> 



Disassemble a range of bus cycles, 
starting at the specified value and 
proceeding back in time. (Not available 
with the 68020 processor.) 



DT <value> 



Disassemble a page of trace starting at 
<value>. 



Comments 



This command is valid only in pause mode, unless you have the dynamic trace 
feature. 

A page is defined by the CRT length parameter in the SET menu. 

The sequence #0 is always the most recently recorded bus cycle in trace memory. If 
an argument is specified to the DT command, the values refer to the raw trace 
sequence numbers. 

The sequence number shown is a decimal value. For numbers larger than 9, precede 
with a decimal ( # ) base sign. 

When using the disassemble trace (DT) and the display register (DR) on the same 
line, make sure you enter DT before DR, because DT will overwrite the current line. 
It does this so that the STP;DT command used repeatedly will give a listing similar 
to a program listing without the STP;DT line between each command. 
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DISASSEMBLE TRACE MEMORY (cont.) 



68020 

Disassemble trace (68020 microprocessor) requires the following: 

• You must be in trace mode 2 (Set parameter #4, page 5-5). An error message will 
display if you are not in trace mode 2. 

• The CDS switch must be enabled (ON) to disable the processor instruction cache 
if the target system runs with the cache enabled. 

Examples 

These two commands used in conjunction will give the user output similar to a 
program listing. 

>STP;DT 
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DISASSEMBLE TRACE MEMORY, (cont.) 



>DT 0 


£\ULJ£\ 




L V 1L\ Hi Irl \J L\ -L 


WirililVnIMU IT lijliUO nilU 

one fYfT P data 


0051 




64EA 


BCC . S 


$0000017E 


0047 




1 3C20000 


1 1\J V Cj ■ Jj 


DP S0000A001 






AO 01 




0000A001<3C 


0044 


oooooi 84 


D081 


ADD . L 


Dl DO 


0043 


000001 86 


64000008 


BCC -W 


$00000190 


003 9 


00000190 


D885 


ADD . L 


D5, D4 


0038 


000001 9? 


64EA 


BCC . S 


$0000017E 


0034 


0000017E 


13C20000 


MOVE .B 


D2, $0000A001 






AO 01 




0000A00K3C 


0031 


nnnnm 


D081 


ADD . L 


Dl DO 


0030 




64000008 


BCC . W 


$00000190 


0026 


nnnnm an 


D885 


ADD . L 


D5 D4 


0025 


nnnnm Q9 


6 4EA 


BCC . S 


U \J U \J \J J- 1 Hi 


U Uz _L 


nnnnm 7t? 

UUUUUl / £j 




iriw vd .is 


n? <;nnnn addi 






A001 




0000A00K3C 


0018 


00000184 


D081 


ADD .L 


Dl, DO 


0017 


00000186 


64000008 


BCC.W 


$00000190 


0013 


00000190 


D885 


ADD . L 


D5,D4 


0012 


00000192 


64EA 


BCC.S 


$0000017E 


0008 


0000017E 


13C20000 


MOVE.B 


D2, $0000A001 


> 




A001 




0000A00K3C 



SEQ# Correlates the disassembled instruction to the raw trace bus 

cycle. 

This is a decimal number and must be preceded by a "#" 
sign when referenced for selective disassembling of the 
trace. This corresponds to the line number in the DRT 
command display. 

ADDR The memory address or location where the instruction was 

fetched. 

OPCODE The machine-language (hex number) equivalent of the 

following assembly-language instruction. 

MNEMONIC The command used to invoke the instruction. 
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DISASSEMBLE TRACE MEMORY (cont.) 



OPERAND FIELD The assembly-language instruction. 

BUS CYCLE DATA The bus cycle transaction, if any, that occurred as a result of 
the instruction. This includes any information written to, or 
read from, memory or I/O locations. If several branches are 
taken within a short period of time the trace disassembler 
may not be able to decide which branches were taken. 
These instructions are tagged with question marks. 
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SELECT TIMER FREQUENCY (68020) 



Command 



Result 



TIM = <n> 



Set time stamp resolution: 



1-0.1 MHz 



2- 1.0 MHz 



3 - 10.0 MHz 



TIM 



Display time stamp resolution. 



Default: 10 MHz 



Comments 



The timestamp counter operates at a default frequency of 10 MHz. In hardware, the 
counter is a 24-bit binary counter that "wraps around" to zero and restarts after 
16,777,215 counts. This is equivalent to 1.6777216 seconds at 10 MHz. The 
timestamp counter frequency can be decreased to 1 MHz or 100 KHz by using the 
TIM command. Decreasing the frequency allows you to measure longer time 
intervals. 
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SELECT TIMER FREQUENCY (68020) (cont.) 



Examples 



>TIM 

$00000003 
>TIM = 2 

MUX FREQUENCY =1.0 MHz 
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DISPLAY RAW TRACE (68020) 



Command 



Result 



DST 

DST <line number> 
DST <range> 



Display the last page of bus cycles 
recorded in trace memory with full 
timestamp resolution. 

Displays a page of the trace buffer starting 
with <line number>. 

Display the range of line numbers. XON 
and XOFF may be used to start and stop 
scrolling if the range is larger than the 
console display. 

Note that the range is a range of bus 
cycles, not the address recorded in the 
trace memory. 
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DISPLAY RAW TRACE (68020) (cont.) 



Comments 



Set parameter #13 sets the page length. (Refer to page 5-6). 

This command is valid only in pause mode, unless you have the dynamic trace 
feature. 

See DRT, page 5-92, for an alternative way to display the raw trace bus cycles. 

The DST command provides greater timestamp resolution than the DRT command. 
The DSACK, SIZE, and OCS bits are always displayed in raw trace with the DST 
command (as shown in the following examples), regardless of which trace mode is 
used. 
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DISPLAY RAW TRACE (68020), (cont.) 



Examples 



TRACE MODE Q 

>DST 



LINE 


ADDRESS 


DATA 


R/W 




FC 


DS 


sz 


ocs 


TIME 




#20 


F0053C 


> 


51CB 


R 


TAR 


SP 


01 


00 


0 


0 


3074177 


SEC 


#19 


F0053E 


> 


FFF8 


R 


TAR 


SP 


01 


10 


1 


0 


3074183 


SEC 


#18 


F00540 


> 


6024 


R 


TAR 


SP 


01 


00 


0 


0 


3074194 


SEC 


#17 


F00542 


> 


4 AO 3 


R 


TAR 


SP 


01 


10 


1 


0 


3074201 


SEC 


#16 


F00534 


> 


007E 


R 


TAR 


SP 


01 


00 


0 


0 


3074207 


SEC 


#15 


F00536 


> 


301A 




TAR 


SP 


01 


10 


1 


0 


3074214 


SEC 


#14 


F00538 


> 


E309 


R 


TAR 


SP 


01 


00 


0 


0 


3074221 


SEC 


#13 


F0053A 


> 


6506 


R 


TAR 


SP 


01 


10 


1 


0 


.3074227 


SEC 


#12 


F005BA 


> 


0000 


R 


TAR 


SD 


01 


10 


0 


0 


3074235 


SEC 


#11 


F0053C 


> 


51CB 


R 


TAR 


SP 


01 


00 


0 


0 


3074242 


SEC 


#10 


F0053E 


> 


FFF8 


R 


TAR 


SP 


01 


10 


1 


0 


3074248 


SEC 


#9 


F00540 


> 


6024 


R 


TAR 


SP 


01 


00 


0 


0 


3074259 


SEC 


#8 


F00542 


> 


4A03 


R 


TAR 


SP 


01 


10 


1 


0 


.3074266 


SEC 


#7 


F00534 


> 


007E 


R 


TAR 


SP 


01 


00 


0 


0 


.3074272 


SEC 


#6 


F00536 


> 


301A 


R 


TAR 


SP 


01 


10 


1 


0 


.3074278 


SEC 


#5 


F00538 


> 


E309 


R 


TAR 


SP 


01 


00 


0 


0 


.3074286 


SEC 


#4 


F0053A 


> 


6506 


R 


TAR 


SP 


01 


10 


1 


0 


3074292 


SEC 


#3 


F005BC 


> 


0000 


R 


TAR 


SD 


01 


10 


0 


0 


.3074300 


SEC 


#2 


F0053C 


> 


51CB 


R 


TAR 


SP 


01 


00 


0 


0 


.3074306 


SEC 


#1 


F0053E 


> 


FFF8 


R 


TAR 


SP 


01 


10 


1 


0 


.3074313 


SEC 



#0 BREAK 



5-109 



DISPLAY RAW TRACE (68020) (cont.) 



TRACE MODE 1 

>DST 



LINE 


ADDRESS 


DATA 


R/W 




FC 


DS 


SZ 


ocs 


TIME 




#20 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955394 


SEC 


#19 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955400 


SEC 


#18 


F00540 


> 


6024FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955411 


SEC 


#17 


F00542 


> 


4A03FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955418 


SEC 


#16 


F00534 


> 


007EFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955424 


SEC 


#15 


F00536 


> 


301AFFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955431 


SEC 


#14 


F00538 


> 


E309FDFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955438 


SEC 


#13 


F0053A 


> 


450 6FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955444 


SEC 


#12 


F005B4 


> 


004AFFFF 


R 


TAR 


SD 


01 


10 


0 


1 


.3955452 


SEC 


#11 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.1955459 


SEC 


#10 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955465 


SEC 


#9 


F00540 


> 


6024FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955476 


SEC 


#8 


F00542 


> 


4A03FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955483 


SEC 


#7 


F00534 


> 


007EFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955489 


SEC 


#6 


F00536 


> 


301AFFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955495 


SEC 


#5 


F00538 


> 


E30 9FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955503 


SEC 


#4 


F0053A 


> 


650 6FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955510 


SEC 


#3 


F005BC 


> 


005 6FFFF 


R 


TAR 


SD 


01 


10 


0 


1 


.3955518 


SEC 


#2 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.3955524 


SEC 


#1 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.3955531 


SEC 



#0 BREAK 
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DISPLAY RAW TRACE (68020), (cont.) 



TRACE MODE 2 

>DST 



LINE 


ADDRESS 




DATA 


R/W 




FC 


DS 


sz 


ocs 


TIME 




#20 


FFF21C5E 


< 


FFFBFFFB 


w 


TAR 


SD 


01 


00 


0 


1 . 


2638674 


SEC 


#19 


FFF21C60 


< 


00400040 


w 


TAR 


SD 


01 


10 


1 


1 . 


2638680 


SEC 


#18 


FFF21C5A 


< 


FFF2FFF2 


w 


TAR 


SD 


01 


00 


0 


1 


2638688 


SEC 


#17 


FFF21C5C 


< 


04220422 


w 


TAR 


SD 


01 


10 


1 


1 


2638694 


SEC 


#16 


FFF21C56 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


2 638700 


SEC 


#15 


FFF21C58 


< 


00000000 


w 


TAR 


SD 


01 


10 


1 


1 


'"i n m m 

2638707 


SEC 


#14 


FFF21C52 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


2638714 


SEC 


#13 


FFF21C54 


< 


00000000 


w 


TAR 


SD 


01 


10 


1 


1 


2638720 


SEC 


#12 


FFF21C4E 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


2638728 


SEC 


#11 


FFF21C50 


< 


00080008 


w 


TAR 


SD 


01 


10 


1 


1 


2638734 


SEC 


#10 


FFF21C4A 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


.2638741 


SEC 


#9 


FFF21C4C 


< 


00FE00FE 


w 


TAR 


SD 


01 


10 


1 


1 


.2638748 


SEC 


#8 


FFF21C46 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


.2638755 


SEC 


#7 


FFF21C48 


< 


00030003 


w 


TAR 


SD 


01 


10 


1 


1 


.2638761 


SEC 


#6 


FFF21C42 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


.2638768 


SEC 


#5 


FFF21C44 


< 


00030003 


w 


TAR 


SD 


01 


10 


1 


1 


.2638774 


SEC 


#4 


FFF21C3E 


< 


00140014 


w 


TAR 


SD 


01 


00 


0 


1 


.2638781 


SEC 


#3 


FFF21C40 


< 


000C000C 


w 


TAR 


SD 


01 


10 


1 


1 


.2638788 


SEC 


#2 


FFF21C3A 


< 


00000000 


w 


TAR 


SD 


01 


00 


0 


1 


.2638795 


SEC 


#1 


FFF21C3C 


< 


00010001 


w 


TAR 


SD 


01 


10 


1 


1 


.2638801 


SEC 



#0 BREAK 
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DISPLAY RAW TRACE (68020) (cont.) 



MODE 3 DISPLAY 

>DST 



LINE 


ADDRESS 




DATA 


R/W 




FC 


DS 


sz 


ocs 


TIME 




#20 


FFF21C5E 


< 


FFFB 


W 


TAR 


SD 


01 


00 


0 


0 


.5001831 


SEC 


#19 


FFF21C60 


< 


0040 


W 


TAR 


SD 


01 


10 


1 


0 


.5001838 


SEC 


#18 


FFF21C5A 


< 


FFF2 


W 


TAR 


SD 


01 


00 


0 


0 


.5001844 


SEC 


#17 


FFF21C5C 


< 


0422 


w 


TAR 


SD 


01 


10 


1 


0 


.5001851 


SEC 


#16 


FFF21C56 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001857 


SEC 


#15 


FFF21C58 


< 


0000 


w 


TAR 


SD 


01 


10 


1 


0 


.5001863 


SEC 


#14 


FFF21C52 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001870 


SEC 


#13 


FFF21C54 


< 


0000 


w 


TAR 


SD 


01 


10 


1 


0 


.5001876 


SEC 


#12 


FFF21C4E 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001883 


SEC 


#11 


FFF21C50 


< 


0008 


w 


TAR 


SD 


01 


10 


1 


0 


.5001889 


SEC 


#10 


FFF21C4A 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001895 


SEC 


#9 


FFF21C4C 


< 


00FE 


w 


TAR 


SD 


01 


10 


1 


0 


.5001902 


SEC 


#8 


FFF21C46 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001908 


SEC 


#7 


FFF21C48 


< 


0003 


w 


TAR 


SD 


01 


10 


1 


0 


.5001915 


SEC 


#6 


FFF21C42 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001921 


SEC 


#5 


FFF21C44 


< 


0003 


w 


TAR 


SD 


01 


10 


1 


0 


.5001927 


SEC 


#4 


FFF21C3E 


< 


0014 


w 


TAR 


SD 


01 


00 


0 


0 


.5001934 


SEC 


#3 


FFF21C40 


< 


OOOC 


w 


TAR 


SD 


01 


10 


1 


0 


.5001940 


SEC 


#2 


FFF21C3A 


< 


0000 


w 


TAR 


SD 


01 


00 


0 


0 


.5001947 


SEC 


#1 


FFF21C3C 


< 


0001 


w 


TAR 


SD 


01 


10 


1 


0 


.5001953 


SEC 



#0 BREAK 
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DISPLAY RAW TRACE (68020), (cont.) 



UNE 



ADDRESS 
DATA 



RIW 

TARIOVL 



FC 

DS (68020, Mode 1,2) 

SZ (68020, Mode 1,2) 
OCS (68020, Mode 1,2) 

TIME (68020) 



Line number 0 in the trace buffer indicates 
the last bus cycle prefetched or executed 
before the ES 1800 went into pause mode. 
The larger the LINE number the further 
back in the history of the program you are 
viewing. You can get a good idea of the 
relationship of bus cycles to instructions 
by matching the bus cycle LINE numbers 
in the DRT to the SEQ# in the 
disassembled trace. 



The address displayed is where the bus 
cycle took place, along with the DATA 
written to, or read from, that address. 

> and < are data direction indicators. 
They display whether data was read from 
an address (>) or written to an address (<). 
These same indicators are used in the trace 
disassembly. 

Indicates whether the cycle was a read or 
a write. 

TAR/OVL indicates whether the access 
was in the target memory area or in the ES 
1800's overlay memory (see DM 
command to determine what addresses are 
mapped). 

Indicates the state of FCO-2. 

Indicates the state of DSACKO and 
DSACK1. 

Indicates the state of SIZO and SIZ1. 

Indicates whether the OCS signal was 
asserted. 

Indicates the elapsed time since emulation 
was entered. 
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SEARCH RAW TRACE (68020) 



STA <address> Search raw trace for address. Enter 

address pattern that looks like raw trace. 

STD <data> Search raw trace for data. Enter data 

pattern that looks like raw trace. 

STS <status> Search raw trace for status. See page 8-29 

for the position and meaning of the traced 
status bits. 



Comments 



The code only looks for the amount of information appropriate to the current trace 
mode. That is, in trace mode 0 it only looks for a 24 bit address pattern since that is 
all that is traced. 



Examples 



STA 


1680 


address 1680 only 


STA 


i6xx or 




STA 


1600 DC OFF 


addresses 1600 through 16FF 


STS 


50 dc %iiiiiiiiioooiiii or 




STS 


SD 


all Supervisor Data cycles 


STS 


WR 


all write cycles 


STS 


SP+BYT+RD 


all byte reads from Supervisor program space 



The ES 1800 response is to display all occurrences of the matched pattern in trace 
memory in the same format as for DRT (page 5-92). The first line is preceded by the 
raw trace header. If there are more lines than the current screen length, the display 
pauses at the bottom of the screen and waits for a key from the user. <return> 
continues the trace search. Any other key aborts the search. 
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DISASSEMBLE TRACE PAGE 



Command 



Result 



DTB 



Disassemble the previous page of trace 
memory (from current trace memory 
pointer). 



DTF 



Disassemble the following page of trace 
memory (from the current trace memory 
pointer). 



Comments 



This command is valid only in pause mode, unless you have the dynamic trace 
feature. 

A page is defined by the CRT length parameter in the SET menu. Three lines are 
subtracted for header and prompt lines. 

Refer also to the DT command, page 5-101, the DRT command, page 5-92, and the 
repeat command, page 5-124. 
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Macros 

A macro defines a list of commands or expressions that are executed with one 
command key word. This allows you to execute repetitive operations quickly and 
easily. 

You can define up to ten macros. They are referred to by the decimal numbers #0-9. 
The ten macros are linked in one buffer with #1 first, #2...#9, and #0 last. 

If the lengths of all ten macros exceeds the buffer length of 125 characters, the 
highest numbered macro is truncated. 

EXAMPLE: If macros #1 to #8 are defined and in this process have used up all of the 
space in the buffer, then an attempt to define macro #9 and #0 would result in those 
macros remaining null. Also, if the length of any macro from #1 to #7 was increased 
after filling the buffer, then macro #8 would be truncated. If the increase was more 
than the size of macro #8, macro #8 would become null and macro #7 would be 
truncated. 

There are no warnings when truncation or nullification takes place. If a number of 
long macros are defined, execute the MAC command to determine if the macros of 
the highest numbers are still intact. Using the general purpose registers in macros 
will help save the number of characters used. 

Macros can be saved in the ES 1800 EEPROM. Refer to the LD and SAV (pages 
5-28 and 5-26) commands for information on saving and reloading macros. 
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DISPLAY DEFINED MACROS 



Command Result 



MAC Display all denned macros in order 1-9,0 

identified by three character sequences. 



Examples 



>_1=DR;DIS CS:IP LEN 4; RUN 
>_2=DB; SS:SP LEN 10; @' Data_ptr 
>MAC 

_1=DR;DIS CS:IP LEN 4; RUN 
_2=DB; SS:SP LEN 10;@' Data_ptr 
> 
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DEFINE/EXECUTE MACROS 



Command Result 

_<0-9>= <com, exp, op> Define the specified macro. 

_<0-9> Execute the specified macro. 



Comments 



A space between the underscore and digit, or digit and equals sign causes an error. 

There are shorthand notations for two macros* a comma as the first character on a 
line executes macro #1 and a period as the first character on a line executes macro 
#2. 



Examples 



Three macros have been defined. Macros #1 and #2 can be executed independently. 
Macro #3 contains two nested macros (#1 and #2). 

Macros are not expanded when the macro is defined, so the definition of macro #3 
may change depending upon the content of macros #1 and #2. 
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DEFINE/EXECUTE MACROS, (cont.) 
In this example, Macro #2 uses a general purpose register as a counter. 



>_1=STP;DT 
>_2=GD1=GD1+1 
> 3= 1; 2 



Step and disassemble one instruction at a time. 



> 1= DB USP LEN 20;RET;DIS PC LEN 12 



Display the first 20H bytes on the stack, skip a line for readability and disassemble 
the next instructions that will be executed. 

There is no display on the screen and no syntax checking when a macro is defined. 
Errors are only detected when the macro is executed. 

Macro number three is executed. 



> 3 
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CLEAR MACROS 



Command Result 



CMC Clear all defined macros. 

_<0-9>= Clear the specified macro. 

Examples 

Clear macro #1. 

> 1= 
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System Commands 



The Repeat Operators 

The command repeat feature provides a way to repeat a command line a specified 
number of times, or indefinitely. A repeat is indicated by an asterisk ( * ) at the 
beginning of a command line. The asterisk is followed by an optional decimal 
argument to specify the number of times to repeat the buffer contents. If the 
argument is zero, the buffer content is not executed. For example: 



>*5STP;DT 
>*5 STP:DT 
>* 5 STP;DT 



In these three equivalent examples, the STP;DT command is repeated five times. If 
the slash key is typed after the above example is input, the entire line is repeated, 
causing five more STP;DT commands to be executed. 

The repeat argument must be specified in decimal, not in hex, or as a variable, and 
there must be a space following the repeat count if the next character is a decimal 
digit. 

32 

When the repeat argument is not specified it is assumed to be 434,967,295 (2 -1). 
A repeat can always be terminated by executing a reset. However, this will also 
abort emulation if it is in progress, without saving the state of the CPU. 

The TST register is used to terminate repeats by setting it to zero with an expression 
in the command line. It is tested just before the command line is executed and if it 
has become zero, the command buffer is not executed and the repeat halts. 

To single step and disassemble until a particular address is reached: 



>*STP;DT; TST=PC-$C324 



If you are waiting for a RAM location to be cleared: 



>*STP;DT;TST=@87020 



You can use the reset character to stop the repeat if the specified test conditions are 
never reached. 

The TST register is set to all 1 's at the start of a repeat. This is necessary so that the 
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register is in a known state at the start of a repeat loop. 

Repeats can also be terminated by the states of the limit (LIM) and index (IDX) 
registers. Just before execution begins, the values of LIM and IDX are compared. If 
IDX is greater than or equal to LIM, the repeat is terminated. The LIM registers is 
initialized to the number of times the loop will execute, which is the decimal loop 
count you specified in the command line. 

IDX is a counter. It starts at zero and is incremented every time the repeat loop is 
executed. You may assign new values to these registers within repeat command lines 
if you wish. 



Examples 



The following examples show some interesting uses of the LIM and IDX registers. 
If you need a decimal counter: 



>BAS IDX=#10 

>*3 IDX 

#0 

#1 

#2 
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System Commands 



Initialize a block of memory to a decrementing count ending in zero, then display it 



>BYM; M 


$1000 




$001000 


$34 


>*4 LIM-IDX-1 


$001001 


$C0 




$001002 


$ BF 




$001003 


$00 




$001004 


$21 


>M MMP-4 


$001000 


$03 


>*4 


$001001 


$02 




$001002 


$01 




$001003 


$00 




$001004 


$21 


> 
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REPEAT COMMAND LINE 



Command Result 



/ Re-execute the previous command line. 

No <return> is necessary. 



Comments 



The slash must be the first character on a line to be recognized as the repeat 
character. 



Examples 



This causes the system to single step and disassemble the instruction just executed. 



>STP;DT 

>/ 

>/ 

>/ 

>/ 



This causes the system to single step and disassemble memory starting at the program 
counter (PC) location. 



>STP;DIS PC LEN 10 
>/ 
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System Commands 



Symbols 

Symbol definitions provide the capability to refer to addresses and data values using 
names, rather than numbers. Symbols are 32 bit integer values and sections are 32 bit 
ranges. Symbols and sections are sometimes collectively referred to as symbols. 

There is a total of 64K bytes of RAM allocated for symbol definitions. To determine 
approximately how many symbols you can define, take the average symbol name 
length, add six and divide into 64K (64 x 1024). 

Symbols are not typed within the ES 1800, thus all symbols are global. This implies 
that a symbol and a section may not be defined using the same name, a symbol name 
may only be defined once, and section range values may not overlap. 

Symbols may be redefined by assigning a new value to the symbol name. If you want 
to reassign a symbol name to a section value, or if you want to change the range 
value of a section, you need to delete the symbol or section name before assigning 
the new value. 

Most compilers and assemblers create symbol tables from the symbols defined in 
your program. These symbols can be easily downloaded if you have a linker and 
converter that can create Extended Tekhex serial data records. See the SET 
command (page 5-3) for the serial data format variable. If you are going to download 
sections that have already been defined (perhaps from a previous download of the 
same file), purge all symbols or delete the section definitions from memory before 
downloading. If you do not, an error occurs when you attempt to redefine the value 
of a section and the download will abort. 

Symbols may be used as parameters to any ESL commands. The only limitation on 
symbols is that they cannot be used meaningfully with the colon operator. The single 
line assembler accepts symbols as address references and data values. 

Memory and Trace disassembly display symbol names in place of absolute values for 
address fields. The following examples illustrate the difference when the same 
program is disassembled with and without symbol definitions. 
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First, the symbols are denned. 



>SYM 




$00000166 


LOOP 


$00003000 


I/O_port_0 


>SEC 




$00000166 


TO $000001 6C DEMON. MODULE 


> 





The following example shows memory disassembly with symbol definitions. 







OPERAND 




BUS CYCLE 


SEQ# ADDR OPCODE 


MNEMONIC 


FIELDS 




DATA 


SEC: DEMON. MODULE 










000 9+LOOP 










0009+000000 31C23000 


MOVE.W 


D2, I/0_PORT 


_0 


003000<8787 


0008+000004 D081 


ADD . L 


D1,D0 






0007+000006 64000004 


BCC.L 


$000172 






0006 000172 D885 


ADD .L 


D5,D4 






0005 000174 64F0 


BCC.S 


$LOOP 






SEC: DEMON. MODULE 










0004+LOOP 










0004+000000 31C23000 


MOVE.W 


D2, I/0_PORT 


_0 


003000<8787 


0003+000004 D081 


ADD .L 


D1,D0 






0002+000006 64000004 


BCC.L 


$000172 






0001 000172 D885 


ADD . L 


D5,D4 






0000 000174 64F0 


BCC.S 


$Loop 
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DISPLAY SYMBOLS 



Command 



Result 



SYM 



SYM <value> 



Display all defined symbols. 

Display all symbols assigned the specified 
value. 



'<symbol> 



Display the value of the specified symbol. 



Examples 



>'sym = 1000 
>' start = 8000 
>'end = 'start +37E 
>SYM 

$00001000 sym 
$00008000 start 
$0000837E end 
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DISPLAY SECTION 



Command 



Result 



SEC 

SEC <value> 

'<section> 

Examples 



Display all currently defined sections and 
their values. 

Display the section assigned the specified 
value. 

Display the value of the specified section. 



>'sec = 1000 


LEN IF 




>' init mod = 


'start TO 


'end 


>'ram =$0100 


TO $0FFF 




>SEC 






$00001000 TO 


$0000101F 


sec 


$00008000 TO 


$0000837E 


init_mod 


$00000100 TO 


$00000FFF 


RAM 
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SYMBOL DEFINITION 



Command Result 



'<symbol> = <value> Assign the <value> to the specified 

symbol. 



Comments 



A space indicates the end of the symbol name. Symbol names can be up to 64 
characters long, but only 16 character names can be uploaded and downloaded. 

<symbol> Any combination of ASCII characters with decimal values in the 
range 33-126. This range includes all of the printable ASCII 
characters. 

<value> A 32 bit integer value or a range. 

Be sure to end a symbol name with a space when assigning a value. If a space is not 
entered as the last character of a symbol name, the characters that follow will be 
recognized as a continuation of the symbol. 

Once you type the single quote, the ES 1800 will display what you type in lower case 
letters unless you explicitly type upper case letters (using the shift key). After a space 
is typed (ending the symbol name) display will revert back to all upper case letters. 

If a symbol name is assigned a value that is a range, it is assumed that you are 
defining a section. Section range values cannot overlap. 
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SYMBOL DEFINITION (com.) 



Examples 



"testing" is recognized as the symbol. 



>' testing =GR0 



"testing=GRO" is recognized as the symbol name. The name will probably not be 
found and you will get an error message. 



>' testing=GRO 

1 

>? 

ERROR #77 

UNDEFINED SYMBOL OR CHARACTER DETECTED 



>'section_X =1000 TO 1FFF 

>'main_loop ='prog_start TO ' RAM_START - 1 
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DELETE A SYMBOL OR SECTION 



Command 



Result 



DEL '<symbol> 



DEL , <section> 



Delete the specified symbol. 
Delete the specified section. 



Examples 



>SYM 

$00001000 Sym 
$00008000 start 
>DEL 'Sym; SYM 
$00008000 start 



> 
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DELETE ALL SYMBOLS AND SECTIONS 



Command Result 



PUR Purge all symbols and section references. 



Comments 



Be sure to purge before downloading symbols that may already be defined. If you 
don't, an error occurs and the download will be aborted. 



>SYM 




$00001000 sym 




$00008000 start 




$0000837E end 




>SEC 




$00001000 TO $0000101F 


sec 


$00008000 TO $0000837E 


init mod 


$00000000 TO $0000FFFF 


RAM 


>PUR;SYM;SEC 




> 
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System Commands 

Miscellaneous Commands 

This section includes three commands: 

1. REV - display the software revision dates 

2. RET - display a blank line 

3. CTS - convert time stamp counter value 
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DISPLAY THE SOFTWARE REVISION DATES 



Command Result 



REV Display the software revision dates for 

ESL and the firmware. 



Comments 



This command is valid only in pause mode. 

If you call Applied Microsystems Corporation Customer Service, they will ask you 
what software revisions are in your machine. This command gives you this 
information. 



Examples 



>REV 




















WED AUG 


6 


08 


50 


26 


PDT 


1986 


- ESL 


2 


2 


WED AUG 


6 


16 


50 


26 


PDT 


1986 


- EMU 


3 


12 


> 
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DISPLAY A BLANK LINE 



Command Result 



RET Executes a <return> , linefeed. 



Comments 



This command is used to improve readibility when displaying multiple lines of data. 



Examples 



Display two blocks of data, separating them with a blank line. 



>DB 0 LEN 


20 ;RET; DB 100 LEN 


20 




















00000000 


00 00 9F FE 00 00 


01 


00 


- 00 


00 


01 


AC 


00 


00 


01 


B2 


00000010 


00 00 01 B8 00 00 


01 


BE 


- 00 


00 


01 


C4 


00 


00 


01 


CA 


00000100 


30 3C 01 00 13 FC 


00 


FF 


- 00 


00 


AO 


01 


13 


FC 


00 


FE 0< 


00000110 


00 00 AO 01 13 FC 


00 


FC 


- 00 


00 


AO 


01 


13 


FC 


00 


F8 
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CONVERT TIME STAMP COUNTER VALUE 



Command Result 



CTS <value> 



Converts <value> to the corresponding 
number in the Time Stamp Module 
counter sequence. 



Comments 



This command is valid with the optional Time Stamp Module and 68000/08/10 
emulators only. 

This command is used when you wish to set up the Event Monitor System to perform 
an action when the time stamp counter reaches a particular value. Since the time 
stamp counter is not a standard binary counter, the desired value must be converted 
using this command before you enter it into the appropriate Event Monitor System 
comparator. 



Example 



To perform an Event Monitor System action when the time stamp counter reaches 
#2000: 



>CTS #2000 
$0438 



You can now enter the converted value $0438 into the desired Event Monitor System 
comparator. See the Time Stamp Module section in Chapter 7 for more details. 
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Section 6 



TARGET COMMANDS 



Introduction 

This section provides a reference to commands that directly control the target system. 
It is divided into sections on running the target program, overlay memory commands, 
the line assembler, the memory disassembler, memory mode and special functions. 

The term 'run mode' is used to indicate that emulation has begun, that is, the 
microprocessor in the pod is running a program in the target. Generally, 'target' 
refers to the hardware and software that you are debugging. If there is no target 
hardware available, the target may be just a program, downloaded into overlay 
memory. The microprocessor in the emulator's pod replaces the microprocessor in 
the target. This provides the ES 1800 control of the processor, which in turn provides 
you with the powerful Event Monitor System and the ability to see what is happening 
within the target system. 

The processor in the pod exercises the target in real time. All processor functions are 
available and valid during emulation. 
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Emulation 



Starting Emulation 

Entry into emulation or run mode is accomplished by executing any of four run 
commands. Two of the run commands load the reset vectors before entering run 
mode, and two of them enable the breakpoints in the Event Monitor. Event system 
breakpoints may be enabled or disabled during run mode. Even if breakpoints are 
disabled, all other Event Monitor System functions are active. 



The reset vectors cannot be loaded during run mode. The following table provides a 
quick reference to the run commands. 





Load 


Break- 




Run 


Reset 


points 


Valid in 


Command 


Vectors 


enabled 


Run mode 


RUN 


NO 


NO 


YES 


RNV 


YES 


NO 


NO 


RBK 


NO 


YES 


YES 


RBV 


YES 


YES 


NO 



Many ES 1800 commands are valid during run mode. If you are unsure whether a 
command may be entered during run mode, just enter iL An error message is 
displayed if it is not valid. Some commands need to communicate with the pod 
processor, and many of these commands can not be entered during run mode, because 
they require halting of emulation in order to complete the command. 
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Target Commands 



The following commands may be entered in run mode, but do halt emulation briefly 
in order to read or write data to the target system or overlay memory. 



M 


- Memory Mode 


@ 


- Indirection Operator 


DB 


- Display Block of Memory 


ASM 


- In-Line Assembler 


DIS 


- Memory Disassembler 


NXT 


- Memory Mode 


LST 


- Memory Mode 



If there are target hardware problems, it may not be possible to enter run mode. In 
these cases, error messages are displayed describing the problem. If the error 
conditions are not cleared, a reset is required to bring the system back into command 
entry mode. 

Halting Emulation 

Emulation can be halted in one of four ways: 

1. Enter the stop emulation command, STP. When this command is entered 
during run mode, emulation is stopped and the values of the microprocessor 
registers are loaded into ES 1800 memory. The current PC and event monitor 
group number are displayed. 

2. The event monitor system can stop emulation if you have set up breakpoints 
and the breakpoints are enabled. When a breakpoint condition occurs , 
emulation is halted, the microprocessor registers are uploaded, and the PC and 
event monitor group number are displayed. 

3. You can reset the pod or ES 1800. This is done by entering a reset command, 
RST, or the system reset character defined in the SET menu. 

4. Emulation breaks automatically if an access or write violation occurs in the 
target system. An error message indicates the condition that caused the error. 
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Using Registers In Run Mode 

Setting and displaying the microprocessor registers during run mode can lead to 
unexpected results because the ES 1800 keeps a RAM image of the microprocessor 
registers. This image is downloaded to the processor whenever run mode is entered. 
The image is uploaded from the processor when emulation is stopped by the STP 
command or the Event Monitor System. 

Because of this, modifying these registers during run mode simply alters the ES 
1800's image of the registers. The ES 1800 does not download the new values of the 
registers to the microprocessor. When emulation is broken, the current values of the 
microprocessor registers are uploaded, and the RAM image is overwritten. Thus, you 
cannot dynamically change the value of the microprocessor registers while 
emulating, and a display register command entered after emulation has begun will 
show you the register values upon entry to emulation, not the values the registers 
currently contain. 
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RUN TARGET PROGRAM 



Command Result 



RBK Begins executing the target program at the 

current PC memory location. If the run 
with breakpoints is executed while already 
in run mode (after a RUN command is 
entered), this will enable breakpoints 
without stopping emulation. 

RBV (68000/08/10) The ES 1800 loads the SSP 

and PC registers with the values located in 
supervisor program space addresses $0 
and $4 respectively, initializes the SR 
register to $2700, and starts emulation 
with breakpoints enabled. 

(68020) The ES 1800 loads the ISP and 
PC registers with the values located in 
supervisor program space addresses $0 
and $4 respectively, initializes the SR 
register to $2700, and starts emulation 
with breakpoints enabled. 

RUN Begins executing the target program at the 

current PC memory location. 

RNV (68000/08/10) The ES 1800 loads the SSP 

and PC registers with the values located in 
supervisor program space addresses $0 
and $4 respectively, initializes the SR 
register to $2700, and starts emulation. 

(68020) The ES 1800 loads the ISP and 
PC registers with the values located in 
supervisor program space addresses $0 
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RUN TARGET PROGRAM (cont.) 



and $4 respectively, initializes the SR 
register to $2700, and starts emulation. 



Comments 



RNV and RBV are valid only in pause mode. 

All defined events are active while RBK and RBV are executing. 

Entering RNV is identical to entering LDV;RUN and entering RBV is the same as 
entering LDV;RBK. 



Examples 



In the following example the ES 1800 begins running the program at the current PC 
register address and breaks (halts emulation) when AC1 is encountered. 



>AC1 = <address>; WHEN AC1 THEN BRK 
>RBK 



In the example below the ES 1800 begins running the program at the current PC 
register addresses, waits for the breakpoint, then disassembles one page. 



>AC1 = <address>;WHEN ACl THEN BRK 
>RBK ; WAI T ; D TB 
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STOP AND STEP TARGET SYSTEM 



Command 



Result 



R>STP 



>STP 



Stop emulation and return to pause mode. 

The screen displays the current PC 
address, the Event Monitor System group 
number, and prompt for further 
instruction. 

From pause mode, the STP command 
executes one instruction. To receive 
visual feedback, combine this command 
with a display command such as STP;DT. 



Examples 



>STP;DR 
>STP;DT 

>STP;DIS PC LEN 4 
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LOAD RESET VECTORS 



Command 



LDV 



LDV;RUN 



Result 



(68000/08/10) The ES 1800 loads SSP 
and PC registers with values located in 
supervisor program space addresses $0 
and $4 respectively and initializes the 
status register (SR) to $2700. 

(68020) The ES 1800 loads ISP and PC 
registers with values located in supervisor 
program space addresses $0 and $4 
respectively and initializes the status 
register (SR) to $2700. 

(68000/08/10) The ES 1800 loads SSP 
and PC registers with values located in 
supervisor program space addresses $0 
and $4 respectively, initializes the status 
register (SR) to $2700, and starts 
emulation with breakpoints enabled. 

(68020) The ES 1800 loads ISP and PC 
registers with values located in supervisor 
program space addresses $0 and $4 
respectively, initializes the status register 
(SR) to $2700, and starts emulation with 
breakpoints enabled. 

NOTE: See the RNV command for auto 
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LOAD RESET VECTORS, (cont.) 



entry of this function. 

LDV;RBK (68000/08/10) The ES 1800 loads SSP 

and PC registers with values located in 
supervisor program space addresses $0 
and $4 respectively, initializes the status 
register (SR) to $2700, and starts 
emulation with breakpoints enabled. 

(68020) The ES 1800 loads ISP and PC 
registers with values located in supervisor 
program space addresses $0 and $4 
respectively, initializes the status register 
(SR) to $2700, and starts emulation with 
breakpoints enabled. 
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LOAD RESET VECTORS (cont.) 



Comments 

This command valid in pause mode only. 

RNV and RBV also load the reset vectors, then enter run mode. 

To verify that the reset vectors are loaded, execute the DR command or individually 
display the PC and SSP (ISP for 68020) registers. 

Refer also to Registers (page 5-68), and the DR command (page 5-74). 
Examples 



Display the registers, then load the reset vectors, clear the address and data registers, 
and verify the changes by redisplaying the register set 



>DR; LDV; CLR; DR 












- 0 - - 1 - 


- 2 - - 3 - 


- 4 - - 5 - 


- 6 - 


- 7 - 


D 


= 5D480000 01030000 


78787878 00000000 


17000000 01000000 


00000000 


00000000 


A 


= 00000000 00000000 


00000000 00000000 


00000000 00000000 


00000000 






SR = .SI7 




SFC = 0 


MSP = 


00000000 






CAAR = 00000000 


DFC = 0 


ISP = 


00009FFE 




PC = 00000190 


CACR = 00000000 


VBR = 00000000 


USP = 


00000000 




- 0 - - 1 - 


- 2 - - 3 - 


- 4 - - 5 - 


- 6 - 


- 7 - 


D 


= 00000000 00000000 


00000000 00000000 


00000000 00000000 


00000000 


00000000 


A 


= 00000000 00000000 


00000000 00000000 


00000000 00000000 


000GO000 






SR = .SI7 




SFC = 0 


MSP = 


00000000 




CCR = 


CAAR = 00000000 


DFC = 0 


ISP = 


00009FFE 


> 


PC = 00000100 


CACR = 00000000 


VBR = 00000000 


USP = 


00000000 
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DELAY EXECUTION UNTIL EMULATION BREAK 



Command Result 



WAI Delay executing the specified command 

until emulation is broken. 



Comments 



Usually this command is used to delay executing a display command until an Event 
Monitor System breakpoint is reached. 

An event may never occur to bring the ES 1800 out of run mode. When this happens, 
use the reset character to reset the system. 

After a reset, the delayed command is lost from the input buffer. 



Examples 



The ES 1800 disassembles a page of trace after a breakpoint is reached. Entering 
RBK;DTB without the WAI command, results in an error. The error message 
COMMAND INVALID DURING EMULATION is displayed. 

RBK;WAI;DTB 



The ES 1800 runs until an access violation or a write violation is encountered, then 
displays a message pointed at by the A4 register. 

RUN;WAI;DIA A4 



6-11 



CYCLE (68010) 



Command Result 



CYC Causes target system to execute a single 

bus cycle. 



Comments 



When executing the CYC command a bus error is initialized automatically. Refer to 
page 5-70 for a listing of the bus errors. This forced bus error will make available the 
stack register information that simulates bus cycles. 

CYC does not actually execute the target program the way a STP command does. 
The individual cycles are simulated by performing peeks/pokes to the target system. 
The ES 1800 does enter RUN while executing the bus cycles. Trace memory does 
not keep a record of transactions to and from the target systems. 

This command is only operable on the 68010 microprocessors. 



6-12 



RESET 



Command Result 

RST The microprocessor reset pin is asserted 

for 512 clock cycles. 

Comments 

The RST command is not valid during emulation. 

The reset pin on the microprocessor is asserted and affects any hardware interfaced to 
it. 



6-13 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



Memory Commands 

Memory commands allow you to modify and display memory in a number of 
different ways. 'Memory' refers to memory in your target system or the ES 1800's 
overlay memory. If the overlay memory is mapped (mapped memory will have the 
RW, RO or ILG attributes assigned to it), read and write accesses are directed to it 
Mapped memory is modified by a memory command even if it is mapped as read 
only. If memory is unmapped, (memory with the TGT attribute assigned to it), 
memory command accesses are directed to the target system memory. Mapped and 
unmapped memory may be interleaved in any way you desire. See the Overlay 
Memory section (page 5-52) for details. 

The default data length affects most memory commands. There are three data lengths 
to choose from: byte mode, (BYM), word mode (WDM), and long word mode 
(LWM). Commands that accept data parameters truncate the data entered to the 
current default data length. If you enter FIN 0 LEN 20,23F6 and the default 
data length is byte mode, the FIN command truncates the data field to F6 and 
searchs the range for that byte. Commands that display data use the current data 
length. 

Some memory commands may be executed during run mode. These commands halt 
emulation for a brief time in order to read from or write to memory. If memory 
commands are executed while in the run mode, remember that you are not emulating 
in real-time. 
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Target Commands 



The following table shows the commands that can be entered in run mode and the 
commands that are affected by the default data length. 



Command 


Legal in 


Uses Default 




Run Mode? 


Data Length? 


DB 


YES 


YES 


FIN 


NO 


YES 


FIL 


NO 


YES 


BMO 


NO 


NO 


VBL 


NO 


NO 


LOV 


NO 


NO 


VFO 


NO 


NO 


ASM 


YES 


N/A 


DIS 


YES 


N/A 


M 


YES 


YES 


e 


YES 


NO 
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DISPLAY MEMORY BLOCK 



Command 



Result 



DB <address range> 



Reads and displays the specified address 
range. 



DB 



Reads and displays one page of memory, 
starting at the last address displayed by 
any previous DB command. On power- 
up, this command displays a page of 
memory from address zero. 



DB <address> 



Reads and displays one page of memory, 
starting at the specified address. 



Comments 



The page length is defined by a parameter in the SET menu. When displaying a 
block of data in byte mode, the ASCII representation of each byte is also displayed. 

The DB command provides an easy way to page through memory. Enter the DB 
<address> command to start reading memory at the desired address. Follow the 
display of this page of data with the DB command, and type a slash / (page 5-124). 
This repeats the DB command to increment the address and scroll through memory. 
If the display is longer than one page, the XON/XOFF characters can be used to start 
and stop scrolling (page 5-3). 

This command affects real time operation when entered in run mode (see page 6-15). 
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DISPLAY MEMORY BLOCK, (cont.) 



Examples 



Displays $20 words pointed to by DO. 



>WDM; DB DO LEN 40 



Displays a page of values pointed at by the value on top of the user stack (see page 
4-11 for information on @ operator). 



>DB @USP 



Display block in byte mode, word mode, and long word mode. 



>BYM 
















>DB 0 


LEN 20 














000000 


80 48 


45 4C 


4C 4F 80 80 - 2F OF 


Fl F9 5E 2F 


F6 FO 


.HELLO. ./. . 




000010 


OF 03 


F0 40 


OF OC F0 40 - 07 06 


FO 90 OF OC 


D8 00 


. . .@. . .@. . 




>WDM 
















>DB 0 


LEN 30 














000000 


4880 


4C45 


4F4C 8080 - 0F2F 


F9F1 2F5E 


F0F6 






000010 


030F 


40F0 


0C0F 40F0 - 0607 


90F0 OCOF 


00D8 






000020 


0FFF 


F9FF 


1FFF 7FFF - 3FFF 


BDFF 1FFF 


FFFF 






>LWM 
















>DB 0 


LEN 30 














000000 


48804C45 


454C8080 0F2FF9F1 


2F5ER0F6 








000010 


030F40F0 


0C0F40F0 060790F0 


0C0F00D8 








000020 


0FFFF9FF 


IFFF7FFF 3FFFBDFF 


IFFFFFFF 
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FIND MEMORY PATTERN 



Command Result 



FIN [.B .W X] <range>, <data> Search <range> for the data pattern. All 

occurrences of the pattern are displayed: 



$<address>=$<data> 



If the pattern is not found within the 
range: 



NOT FOUND 
> 



Comments 



This command is valid in pause mode only. 

Data may be either an integer or don't care value. Find uses the default data length, 
regardless of the length of the <data>. 
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FIND MEMORY PATTERN, (com.) 



Examples 



To find a bit pattern using don't cares use either of the following forms: 



>FIN 1000 TO 2FFF, 60XX 
or 

>FIN 2000 LEN 2000,6000 DC OFF 



Find the initialization data in the start module section. 



>FIN 'start module, ' init_uart 



Find any NOPs in the range. 



>FIN.W 100 TO 1000, 4E71 
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FILL OPERATOR 



Command Result 

FIL[.B .W X,]<range>,<constant> Fills <range> with the <constant> data 

pattern. 

Comments 

This command is valid in pause mode only. 
<constant> must be an integer. 

The fill command uses the default data length, regardless of the length of 
<constant>. 

The fill command can be verified using the VBL (verify block) command (page 6- 
22). 

Examples 

Fill RAM with zero to initialize data space. 

>FIL 2000 LEN 50,0 

Fill RAM section with initialization data. 

>FIL RAM, 'init_data 
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VERIFY BLOCK DATA 



Command 



Result 



VBL <addressrange>, <data> 



Comments 



Verifies that <address range> contains 
the specified data. 

If there are differences: 



$<address> = $XX NOT $YY 



<address> is the address where the 
misverify occurred. 'XX' is the actual data 
at the location. 'YY' is the data specified 
in the command statement. 



This command is valid only in pause mode. 

The VBL command uses the default data length, regardless of the length of <data>. 
Refer also to the MMS command (page 5-79), and the BMO command (page 6-24). 
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VERIFY BLOCK DATA (cont.) 



Examples 



Verify that a range contains $3F. 



>VBL 0 TO 


2000, 3F 




$00000004 


- $00, NOT 


$3F 


$00000126 


- $76, NOT 


$3F 


> 
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BLOCK MOVE 



Command Result 



BMO <range>,<address> 



BMO <range>,<space>,<address> 



BMO <range>,<address> , <space> 



Moves <range> to the new <address>. 
The current value of MMS specifies the 
relocation register used during the 
transfer. 

Moves <range> to the new <address>. 
The <space> argument specifies the 
memory mode status to use during the 
transfer. 

Moves <range> to the new <address>. 
The range is read from the space specified 
in the MMS register. The block is written 
to <space>. 



BMO <range> f <space> , <address>,<space> 

Moves <range> to the new <address>. 
The range is read from <space> specified 
in the argument following the range. The 
block is written to <space> specified in 
the argument following the address. 
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BLOCK MOVE (com.) 



Comments 



This command valid in pause mode only. 

The following rules of thumb may make the numerous forms of this command less 
confusing. If there is no space specified for the source argument, MMS is always 
used (page 5-79). If no space is specified for the destination address, MMD is always 
used. 

A non-overlapping block move can be verified using the VBL command. 



Examples 



Move a range to a new location in supervisor data space. 



>MMS= 








>BMO 


100 TO 


500, 


1000 




or 






>BMO 


100 to 


500, 


SD, 1000 



To move data from range 10 to 20 in supervisor program space to a starting address 
of 30 in supervisor program space: 



MMS = SP 
MMD = SP 

BMO 10 TO 20, 30 



To move data from the range 100 to 200 in supervisor program space to a starting 
address 300 in user data space: 



MMS 


= SP 


MMD 


= UD 


BMO 


100 TO 200, 300 
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BLOCK MOVE, (cont.) 



The following example moves data without setting the MMS and MMD registers. To 
move data from range 400 to 500 in supervisor data space to a starting address of 600 
in user data space regardless of what MMS and MMD are set to: 



BMO 400 TO 500, SD, 600, UD 
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VERIFY BLOCK MOVE 



Command Result 



YBM<range>,<address> 



YBM<range>,<space>,<address> 



YBM<range>,<address>,<space> 



Verifies move of <range> to the new 
<address>. The current value of MMS 
specifies the relocation register used 
during the transfer. 

Verifies move of <range> to the new 
<address>. The <space> argument 
specifies the memory mode status used 
during the transfer. 

Verifies move of <range> to the new 
<address>. The range is read from the 
space specified in the MMS register. The 
block was written to <space>. 



YBM<range>,<space> , <address>,<space> 

Verifies move of <range> to the new 
<address>. The range is read from 
<space> specified in the argument 
following the range. The block was 
written to <space> specified in the 
argument following the address. 
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VERIFY BLOCK MOVE, (cont.) 



Comments 

This command is valid only in pause mode. 

Verifies that a non-overlapping block move was successful. 

Examples 

To verify data from range 400 to 500 in supervisor data space with a range starting 
address of 600 in user data space regardless of what MMS and MMD are set to: 

VBM 400 TO 500, SD, 600, UD 
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LOAD OVERLAY MEMORY 



Command Result 



LOV <range> 



Moves data from the target system 
memory to the ES 1800 overlay memory 
in the specified address range. 



Comments 

This command is valid only in pause mode. 

Refer to the VFO command, page 5-66, to verify the load overlay command. 

To load overlay memory from the target memory, a target system must be connected 
to the ES 1800 emulator and overlay memory installed and mapped. 

To load a target memory range into the overlay memory at a different address, use the 
LOV command, then do a block move of the range. 

Refer also to the Overlay Memory section, page 5-52. 
Examples 

To load overlay memory from Target memory $80000 to $87FFF: 

>LOV 80000 LEN 8000 
>LOV 'BOOT RANGE 
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VERIFY OVERLAY MEMORY 



Command 



Result 



VFO <range> 



Compares <range> in target memory to 
the same range in the overlay memory. 

If there are any differences, the address 
and data difference is displayed: 



Comments 



<address> = XX NOT YY 



'XX' is the data present in overlay 
memory. 'YY' is the data at that location 
in the target system memory. 



This command is valid only in pause mode. 

Refer also to the Overlay Memory section, page 5-52. 
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VERIFY OVERLAY MEMORY (cont.) 



Examples 



To verify the two overlay loads in the LOV command section: 



>VFO 80000 LEN 8000 
>VFO 'BOOT RANGE 
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Target Commands 



Line Assembler 

The Motorola 68000 series line assembler allows you to enter and assemble Motorola 
68000 series mnemonic instructions into target memory. All standard Motorola 
68000 mnemonics listed in the MBit Microprocessor User's Manual or MC68020 32 
Bit Microprocessors User's Manual are supported. In addition to these instructions 
many assembler directives are supported. 

Parameters: 

• Not all arithmetic operators are available for assembly. The following arithmetic 
operators are allowed in an assembler expression: (+ -). Only 16-bit arithmetic 
is performed. For proper usage refer to the section on expressions. 

• Parentheses are allowed in group algebraic expressions. 

• Double quotes (") or a slash sign (/) is used to delineate ASCII strings. If you 
enclose the string in double quotes, you may not use double quotes in the string, 
but any number of slashes may be used. 

If you enclose the string in slashes, you may not use slashes within the string, but 
any number of double quotes may be used. 

• Capital letters is the default for ASCII text The use of <backspace> will 
allow entry of lower case letters within a text string until you enter a <space>. 

• The two number bases are hexadecimal and decimal. Decimal is the default. 
You do not need to enter a # sign to denote decimal numbers. Numbers 
beginning with $ are hexadecimal. All other numbers are decimal. 

• When referencing memory, you must use a leading zero with the program counter 
relative. 

• The pound sign # denotes an immediate addressing mode. 
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Examples 



0 (PC,D3) -PCR with index and displacement. 

0 (A4,D3) -address register indirect with index and displacement. 
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END 
X 



LINE ASSEMBLER 



Command 



Result 



ASM 



Assembly begins at the last address 
displayed during a previous assembly 
session. At power-up the start address 
will be 0. 



>ASM 

**** 680XX LINE ASSEMBLER **** 

000000 >X 

> 



ASM <arg> 



Assembly begins at the specified address. 



>ASM <address> 

**** 680XX LINE ASSEMBLER **** 

000000 >END 

> 



000000 >x 

**** END OF LINE ASSEMBLY **** 
> 



Exit line assembly. 
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LINE ASSEMBLER (cont.) 



Comments 



All 680XX instructions can be entered from the line assembly mode, 
instructions will be converted to machine code and loaded into memory at 
address specified in the prompt. 

The following pages describe the supported assembler directives. 
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ASSEMBLER DIRECTIVES 



Command 



Result 



ORG 



Sets program assembly origin: 



35F300 > ORG $4000 
004000> 



END or X 



Exits from line assembler to the command 
level: 



58FD >X 

****END OF LINE ASSEMBLY**** 
> 



DC 



Defines constant byte, word, long word, or 
text string. 



002400 > DC.W $8034,256, 1024 
002400 8034 0100 0400 
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ASSEMBLER DIRECTIVES (cont.) 



SET Defines/redefines symbol value (only valid 

with local label LO to L9 unless symbolic 
debug is installed). 



75 6A >L<x> 

75 6 A >L<x>SET 

75 6A > 



L0,L1...L9 



Prints value of local symbol: 



75 6A >L3 

75 6A >L3 SET 7A44h 
756A > 



'symbol Prints value of symbol. This is only valid 

if symbolic debug hardware is installed: 



756A 


> 


Unit 


75 6A 


> 


Unit SET FDEOH 


75 6A 


> 
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ASSEMBLER DIRECTIVES, (cont.) 

Disassembles one instruction at the 
current address: 

000100> 

000100 7A75 MOVEQ.L #$75, D5 

Current line assembly address. 

000130 > BRA. S * 
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MEMORY DISASSEMBLER 



Command 



Result 



DIS <range> 



Disassembles and displays the data in the 
specified range. 



DIS <address> 



Disassembles one page of memory 
beginning at a specified address. 



DIS 



Disassembles and displays a page of 
memory beginning at the last address 
display during previous DIS command. 
At power-up this value is 0. 



Comments 



You should be familiar with Motorola 68000 assembly language programming and 
have the 16 Bit Microprocessor User's Manual or the MC68020 32 bit 
Microprocessor User s Manual by Motorola. 

The information presented here is an overview and should be used in conjunction 
with Motorola documentation. 
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MEMORY DISASSEMBLER, (cont.) 



A disassembly command with an integer argument or no argument enters a special 
disassembly mode. The disassembly can be continued by typing a space or <return> 
. It is exited by typing any other character. 

A page of data is defined by a parameter in the SET menu. 

<space> Continues disassembling one line at a 

time. 

<return> Continues disassembling one page at a 

time. 

any char except <space> or <return> Exits disassembly mode. 
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Memory Mode 

Memory mode allows you to view and modify memory using a simple scrolling 
scheme. Enter memory mode by executing the M command. The current address 
and associated data are displayed. If the first character entered on a memory mode 
command line is a <return> , the next address and its data are displayed. If a value is 
entered before the <return> , that value is written to the current address before 
displaying the next address. A list of up to nine values separated by commas may be 
entered after a memory mode prompt These data are stored to consecutive 
addresses. 

The scroll direction is determined by two commands, NXT and LST. NXT (next) 
increments the address and LST (last) decrements the address. Entering either of 
these commands during run or pause mode sets the scroll direction and enters 
memory mode. The scroll direction can also be changed after you have already 
entered memory mode by executing the appropriate command. The scroll direction 
can be manually overridden at any time by using the period ( . ) and comma (, ) keys. 
A period increments the address and a comma decrements it 

The MMP register (memory mode pointer) is always set to the current address being 
accessed. If memory mode is entered without specifying an address, the value in this 
register specifies the starting address. On power-up, MMP is set to zero. 
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ENTER MEMORY MODE 



Command Result 



M [.B .W .L] <address> 
M [.B .W .L] 



Enters memory mode at <address>. The 
address and the data at that address are 
displayed preceding the prompt 

Enters memory mode at the last address 
examined in a previous memory mode 
session. 

The last address is stored in the MMP 
register (memory mode pointer). At 
power-up, this value is zero. 

Exits memory mode. 



Comments 



Affects real-time operation when entered in run mode (see page 6-15). 

Data displayed in memory mode can be in either byte, word, or long word lengths. 
Set byte mode (BYM), word mode (WDM), or long word mode (LWM) before 
entering memory mode. If you are in word mode and enter a byte of data, two bytes 
of data are written: the byte you entered, and a zero. If you are in byte mode and 
enter a word of data, the value is truncated, and only a byte is written. 

The MMP register is modified if you scroll to a new address while in memory mode. 
When you exit memory mode, MMP reflects the last address examined. 

When a <return> is entered as the first character on a line, the address is incremented 
or decremented and the new address and data are displayed. On power-up, the 
default scroll mode is toward increasing memory addresses. To change the scrolling 
direction use the NXT (forward) and LST (backward) commands. These can be 
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ENTER MEMORY MODE (cont.) 



entered in memory mode. If they are entered in pause mode, the scroll mode is set 
and memory mode is entered at MMP. 

The scroll mode can be overridden by using the period and comma keys. A . 
increments the address and a , decrements the address. 

To modify data at a memory location, enter the data and press <retum> . The data 
are written to the current address and the next address and data are displayed. 

Data can be entered quickly using a list. A list can contain up to nine values 
separated by commas. See example below. 



Examples 



Set the MMP and use the NXT command to enter memory mode. Change a word of 
data and verify. 



>WDM; MMP=$FF000; NXT 
$0FF000 $1234 >1122 
$0FF001 $00FF >, 
$0FF000 $1122 >X 



Assume that address $1000 is the start of a data table and you want to write a short 
program to utilize that data. 

Initialize the data using a list. Then invoke the line assembler using MMP as the start 
address (page 6-34). 
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ENTER MEMORY MODE, ( cont.) 



>M 1000 








$001000 $00 


>0, 1,2, 3, 4, 5, 6, 7, 8 






$001009 $00 


>X 






>ASM MMP 








**** 680XX 


LINE ASSEMBLER **** 






1009 > 




Enter your program 


here . 






Use "X" or "END" to 


exit 






the line assembler. 
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EXIT MEMORY MODE 



Command Result 



Exits memory mode. 
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SCROLLING IN MEMORY MODE 



Command 



Result 



<return> 



LST 
NXT 



Scrolls through memory addresses either 
one byte (8 bits) at a time, one word (16 
bits) at a time, or one long word (32 bits) 
at a time. See BYT, WRD, LWM, page 
4-26). 

The <return> key now decrements 
addresses in memory mode. 

The <return> key now increments (default 
mode) addresses in memory mode. 

Increments the address in memory mode. 

Decrements the address in memory mode. 



Comments 



The NXT and LST commands may be entered from either pause, run or memory 
mode. If entered from the run or pause mode the <return> key is set to increment or 
decrement and memory mode is entered at the current value of MMP. 

When a comma or period is entered in the memory mode, this temporarily overrides 
the scrolling direction. 
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MEMORY MODE POINTER 



Command 



Result 



MMP 



Displays the current value of the memory 
mode pointer. 



MMP = <exp> 



Assigns the value <exp> to the memory 
mode pointer. 



Comments 



MMP is the last value examined while in memory mode. If you enter memory mode 
without specifying an address, the MMP value is used as the entry point. 

The default power-up value of the MMP register is zero. This register may be stored 
inEEPROM. 

The memory mode pointer is modified if you change to a new address after entering 
memory mode. When you exit memory mode, the MMP reflects the last address 
examined. 

As with any register, the MMP can be used as a parameter to another command. 



Examples 



Set the MMP and verify. 



>MMP=$12330;MMP 
$00012330 



> 
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Target Commands 



Diagnostic Functions 

The diagnostic functions (also called special functions, or SFs) are a group of utility 
routines and special tests. They are valuable for locating address, data, status or 
control line problems. There are two categories: RAM tests and scope loops. For a 
complete list see the SF command (page 6-49.) 

Ram Tests 

These prewritten tests check that RAM is operating properly. They can be run on the 
target or ES 1800 overlay memory and may be executed in either byte or word mode. 
Byte or word mode must be specified prior to initiating the SF test. 

SF 1 and 3 are modeled after a study by Abraham, Thatte, and Narir entitled Efficient 
Algorithms for Testing Semiconductor Random-Access Memories [IEEE Transaction 
on Computers, vol. c-27, no. 6 June 1978]. Refer to this publication for background 
information on these two diagnostics. 

Scope Loops 

Scope loops are diagnostic routines built into the ES 1800 firmware for use when 
troubleshooting with an oscilloscope. The uses for these special functions range 
from locating stuck address data, status or control lines, to generating signatures 
using signature analysis equipment. 

The firmware is optimized so that the loops execute at maximum speed. This short 
cycle time allows the hardware engineer to review the timing of pertinent signals in 
the target system without using a storage oscilloscope. All of these routines must be 
terminated by resetting the emulator. The scope loops can be executed in either byte 
or word mode. 
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ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



Custom Diagnostics 

Special functions 40-49 allow you to execute up to ten user written diagnostics. In 
the event that the above mentioned RAM tests and scope loops do not provide the 
desired test for your equipment, these custom diagnostics will allow you to 
download, debug, and execute diagnostics of your own design. You may also read or 
write to any address or function code space in the target system and/or overlay 
memory with these diagnostics. 
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SPECIAL FUNCTIONS LIST 



Command Result 



SF Displays list of all available RAM tests, 

scope loops and miscellaneous tests. 



Examples 



>SF 






SF 0,<RANGEXCR> 


SIMPLE RAM TEST, SINGLE PASS 


SF 1,<RANGEXCR> 


COMPLETE RAM TEST, SINGLE PASS 


SF 2,<RANGEXCR> 


SIMPLE RAM TEST, LOOPING 


SF 3,<RANGEXCR> 


COMPLETE RAM TEST, LOOPING 


SCOPE 


LOOPS: 




SF 10, 


<ADDRESS>, <PATTERNXCR> 


READ CONTINUOUSLY FROM ADDRESS 


SF 11, 


<ADDRESS>, <DATAXCR> 


WRITE CONTINUOUSLY TO ADDRESS 


SF 12, 


<ADDRESS>, <PAT 1>,<PAT 2><CR> 


WRITE ALTERNATE PATTERNS 


SF 13, 


<ADDRESS>, <PATTERNXCR> 


WRITE PATTERN, THEN ROTATE 


SF 14, 


<ADDRESS>, <DATAXCR> 


WRITE DATA, THEN READ 


SF 15, 


<RANGEXCR> 


READ DATA OVER ENTIRE RANGE 


SF 16, 


<ADDRESSXCR> 


WRITE INCREMENTING COUNT 


SF 17, 


<CR> 


GENERATE RESET PULSES 


MISCELLANEOUS: 




SF 20 


<CR> 


CRC CHECK OF EMULATOR FIRMWARE 


SF 40- 


49 <CR> 


RUN USER PROGRAMS INTERNAL SPACE 


CLK <CR> 


DISPLAY TARGET CLOCK FREQUENCY 


CRC <RANGE> <CR> 


CALCULATE CRC OF SPECIFIED RANGE 
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SIMPLE RAM TEST, SINGLE PASS 



Command Result 



SF 0, <range> Writes a test pattern to all locations within 

the specified range, then reads each 
location to verify the data. The following 
pattern sequence is used: 



Sequence 


Pattern 


1 


0000 


0000 


2 


0000 


0001 


3 


0000 


0011 


4 


0000 


0111 


5 


0000 


1111 


6 


0001 


1111 


7 


0011 


1111 


8 


0111 


1111 


9 


1111 


1111 


10 


1111 


1110 


11 


1111 


1100 


12 


1111 


1000 


13 


1111 


0000 


14 


1110 


0000 


15 


1100 


0000 


16 


1000 


0000 
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SIMPLE RAM TEST, SINGLE PASS, (cont.) 



Comments 

All RAM tests default to WDM. 

This command is valid in pause mode only. 

If a location is read that doesn't match the test pattern, a failure is reported. 
The address, correct data, and faulty data are displayed. 
If no failure is detected, the following prompt is displayed: 

COMPLETE 

This is a single pass test. 
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COMPLETE RAM TEST, SINGLE PASS 



Command Result 



SF 1, <range> Writes, then reads a test pattern to all 

locations in the specified range. Refer to 
Efficient Algorithms for Test 
Semiconductor Random-Access Memories 
mentioned in the introduction to 
Diagnostic Functions for the test pattern. 



Comments 



All RAM tests default to WDM. 

This command is valid in pause mode only. 

If an error is detected, the associated address, correct data, faulty data, and test 
sequence number are displayed. The sequence number specifies which test in the 
complete list of tests caused the failure. 

This is a single pass test. 



Examples 



MEMORY FAILURE: $00000800=$FFFF, NOT $0000; CODE=$06 



An error is detected. 
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SIMPLE RAM TEST, LOOPING 



Command 



Result 



SF 2, <range> 



Writes a test pattern to all locations in 
<range>, then reads each location to 
verify the data. See SF 0 for test pattern. 
Each time the test is executed, the pass 
count is incremented and displayed on the 
screen. 



Comments 

All RAM tests default to WDM. 

This command is valid in pause mode only. 

If no failure is detected, the pass line is the only line displayed. It is continually 
updated, showing the number of times the test has been executed. 



SF 2, 0 TO 4 



YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



PASS COUNT = $XXXX 
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SIMPLE RAM TEST, LOOPING (cont.) 



If a failure is detected, the problem address, correct data, and faulty data are 
displayed on the line after the pass number line and the test continues. 



>SF 2,0 TO 4 




YOU MUST RESET 


ME TO TERMINATE THIS FUNCTION 


MEMORY FAILURE 


$00000002=$OOFE, NOT $00FF 


PASS # 1 




UNTIL RESET 





You must reset the ES 1800 to terminate this test 
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COMPLETE RAM TEST, LOOPING 



Command Result 



SF 3, <range> Writes a test pattern to all locations within 

<range>, then reads each location to 
verify the data. See SF 1 for test reference 
information. 



Comments 



All RAM tests default to WDM. 

This commands is valid in pause mode only. 

During execution, a pass count is maintained and displayed on the screen. 

If no failure is detected, the pass line is the only line. It is continually updated, 
showing the number of times the test has been executed. 



>SF 3, 0 TO 2 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
PASS COUNT = $XXXX 
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COMPLETE RAM TEST, LOOPING (cont.) 



If a failure is detected the associated address, correct data, faulty data, and test 
sequence number are displayed. 



>SF 3, 0 TO 2 












YOU MUST RESET 


ME TO TERMINATE THIS FUNCTION 




MEMORY FAILURE: 


$00000002=$0400, 


NOT 


$0000; 


CODE= 


$01 




$00000000=$0400, 


NOT 


$0000; 


CODE= 




PASS #1 












MEMORY FAILURE: 


$00000002=$0400, 


NOT 


$0000; 


CODE= 


$01 


MEMORY FAILURE: 


$00000000=$0400, 


NOT 


$0000; 


CODE= 


$03 


PASS #2 












UNTIL RESET 













You must reset the ES 1800 to terminate this test. 
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PEEKS INTO THE TARGET SYSTEM 



Command Result 



SF [.B .W X] 10,<address> 



Consecutively reads from the specified 
memory address using MMS as status 
space register. 



Comments 

This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 

Examples 

> SF 10, $FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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POKES INTO THE TARGET SYSTEM 



Command Result 



SF[.B.WX.]ll,<address>,<data> Consecutively writes the user denned data 

pattern to the specified memory address 
using MMS as status space register. 



Comments 



This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 



Examples 



>SF.B 11,10,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



The data pattern written to address 10 is: 



(BYM) 


(WDM) 


FF 


FFFF 


FF 


FFFF 


FF 


FFFF 
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WRITE ALTERNATE PATTERNS 



Command Result 



SF [.B .W .L] 12, <address>, 
<pattern i>, <pattern 2> 

Consecutively writes the user defined data 
pattern to the specified memory address 
using MMS as status space register 
followed by the complement of that data 
pattern to the same address. 



Comments 



This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 



Examples 



>SF 12,$FF0000,$AA,55 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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WRITE ALTERNATE PATTERNS {com.) 

The following data pattern is written to address $FF0000. 



AA 

55 
AA 
55 



until reset 
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WRITE PATTERN THEN ROTATE 



Command Result 



SF [.B .W. L.] 13, <address>, <pattern> 

Consecutively writes the data pattern to 
the specified memory address using MMS 
as status space register, rotates the pattern 
1 bit to the left and writes to the same 
address. 



Comments 



This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 



Examples 



>SF 13,1000,05 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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WRITE PATTERN THEN ROTATE (cont.) 
The following data pattern is written to address 10: 



05 
OA 
14 
28 
50 
AO 
41 
82 
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WRITE DATA THEN READ 



Command Result 



SF[.B, yV.L]14,<address>,<data> Consecutively writes the specified data 

pattern to the specified memory address 
using MMS as status space register, then 
reads from that same address. 



Comments 



This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 



Examples 



>SF 14, 100,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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READ DATA OVER AN ENTIRE RANGE 



Command Result 



SF [JB .W .L] 15, <range> 



Consecutively reads from the specified 
memory address range using MMS as 
status space register. 



Comments 

This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 

Examples 

>SF 15, 10 TO 20 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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WRITE INCREMENTING COUNT 



Command Result 



SF [.B .W .L] 16, <address> Consecutively writes a constantly 

incrementing value to the specified 
memory address using MMS as status 
space register. 



Comments 



This command is valid in pause mode only. 
You must reset the ES 1800 to terminate this test. 



Examples 



>SF 16, 10 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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GENERATE RESET PULSES 



Command Result 



SF 17 The ES 1800 sends continuous reset pulses 

to the target system. 



Comments 



You must reset the ES 1800 to terminate this test. CTRL Z is the factory default 
reset. 
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CYCLIC REDUNDANCY CHECK 



Command Result 

SF 20 A CRC is calculated on the ES 1800 

internal PROM that contains the ES 1800 
firmware. 

Comments 

This commands is valid in pause mode only. 
This is an ES 1800 self-test. 
If a failure is detected, a CRC error is displayed. 
This is a single pass routine. 
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CUSTOM DIAGNOSTICS 



Command 


Kesuit 


SF <40-49> 


Executes custom diagnostic. 


SF40 


Execute diagnostic at $7000 


SF41 


Execute diagnostic at $7004 


SF42 


Execute diagnostic at $7008 


SF43 


Execute diagnostic at $700C 


SF44 


Execute diagnostic at $7010 


SF45 


Execute diagnostic at $7014 


SF46 


Execute diagnostic at $7018 


SF47 


Execute diagnostic at $70 1C 


SF48 


Execute diagnostic at $7020 


SF49 


Execute diagnostic at $7024 



Comments 



You may determine that the built-in diagnostics and scope loops do not provide the 
proper test for your equipment; for that reason eustom diagnostics are provided to 
allow you to download, debug and execute diagnostics of your own design. 

Custom diagnostics can access or modify parameters stored in GDO-7 and may also 
read or write to any function code space in the target system and/or overlay memory. 
Special functions 40-49 provide the means of executing up to ten custom diagnostics. 

To make a group of diagnostics, you must first create a table containing up to ten 
long-branches that starts at address 7000 Hex. The BRA.L must be present or the 
diagnostic will not be executed. The BRA.L will vector to the start of the user- 
written routine. (This routine must be located in internal RAM, in the range of 7000- 
78FF (3K) unless a JMP command vectors control to overlay memory that is mapped 
at an address above 80000 Hex.) To return control to the emulator, the routine will 
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CUSTOM DIAGNOSTICS, (cont.) 



terminate with an RTS instruction. 

Peeking and Poking into the Target System 

(68010/68020) 

There are four special function codes reserved for the purpose of accessing the target 
and/or overlay from a custom diagnostic. These special function codes can be 
generated by the use of the MOVES instruction. (Refer to the Motorola MC68020 32 
Bit Microprocessor User's Manual.) The function code seen by the target system is 
not the function code that the MOVES instruction generates. Instead, the target 
function code is picked up from a register in the internal memory space. 

The register containing the substitution function code is six bits wide and contains 
two function code values: 

• The lowest three bits of this register (0-2) are referred to as X 

• The upper three bits (3-5) are referred to as Y 

By storing the proper codes in the SFC and DFC registers, it is possible to read from 
one function code space, controlled by X, and write to another function code space, 
controlled by Y. 

Two of the four special function codes are used to access either overlay memory 
exclusively (OVO) or the target exclusively (TGO). The other two codes access the 
target and also overlay memory, when it is mapped. 

The following table lists three columns that show how the three special function 
codes are used. The left column shows the function code that originates at the SFC or 
DFC register inside the CPU; the middle column shows which substitution register is 
used to generate the space code for the target system, and to enable overlay memory; 
the last column indicates the two special function codes that are used to enable the 
target only (TGO) and the overlay only (OVO). 
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CUSTOM DIAGNOSTICS (cont.) 
Use of special function codes: 



Origin 



0 X TGO 

1 X 

3 Y 

4 Y OVO 



Note that before a custom diagnostic can peek or poke to the target, the X and Y 
registers must be initialized. In most cases only the X bits need to be initialized since 
typically one function code space is all that's needed. This register is located at 
address $3F63 in the internal memory space: 



7 


6 


5 


4 


3 


2 


1 


0 


n/c 


n/c 


Y2 


Yl 


YO 


X2 


XI 


xo 



Bits 6 and 7 are not used. Data stored to this register can also be read, so 
read/modify/write instructions like AND and OR will work. 



After the X and Y registers are initialized the SFC and DFC registers can be loaded. 
These registers would typically both be loaded with a $1 to cause the X register to be 
substituted, and to enable both the target system and the overlay memory when it is 
mapped. 
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CUSTOM DIAGNOSTICS, (cont.) 



(68000/68008) 

Unlike the 68010, the 68000 and 68008 processors do not support the MOVES 
instruction. Consequently, the 68000/08 ES 1800s access the target differently. 

When the 68000/08 ES 1800 is not in emulation, the function code seen by the target 
is in a register in the internal memory space. 

The register containing the substitution function code is six bits wide and contains 
the following: 

• The lowest three bits (0-2) are referred to as X. 

• Bit 3 is referred to as OVO (overlay only). 

• Bit 4 is referred to as TGO (target only). 

• Bit 5 is not used. 

In order to read and write to different function code spaces, X must contain the 
function code space before accessing the target. 

Normally during a peek or poke, if the space to be accessed is overlaid, the target and 
overlay memory are accessed simultaneously. However, if accesses to that space in 
the target cause a bus error, you may set the OVO bit and only the overlay will be 
accessed. Likewise, to restrict accesses to the target only, set the TGO bit. 

To access the target (or overlay memory, if it mapped), the diagnostic program must 
generate a function code 1 (user data) during a target read or write. Then the 
function code in the substitution register (located at $3F63 in the internal memory 
space) will be seen by the target. 



7 


6 


5 


4 


3 


2 


1 


0 


n/c 


n/c 


n/c 


TGO 


OVO 


X2 


XI 


xo 



Bits 5, 6 and 7 are not used. Data stored to this register can also be read, so 
read/modify/write instructions like AND and OR will work. 
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CUSTOM DIAGNOSTICS (cont.) 



Download Custom Diagnostics 

A user written diagnostic assembled on a host system may be downloaded to the ES 
1800 internal RAM. 

The diagnostics to be downloaded must be assembled first. 

The introspective mode software switch setting must be enabled (ON IM ) before 
executing a download sequence. 

After enabling the IM switch the ES 1800 is considered a target system and the DNL 
command (page 5-38) may be used in its typical manner for downloading to a target 
system. 

Custom diagnostics will not access your target system when in the introspective 
mode. 

To terminate the download process, set the introspective mode software switch to off 
(OFF IM). The ES 1800 is taken out of introspective mode and no longer is 
considered a target system. 

The system reset character (ctrlz) will also take the ES 1800 out of the 
introspective mode, (ctrlz) is the system default reset character, and SET 
parameter #2 is the user defined reset character (see page 5-3). 

The emulator has 3K of memory space allocated for custom diagnostics. If this is not 
sufficient then overlay memory may be used for additional space. To set up overlay 
memory for custom diagnostics: 

• Map overlay memory only above $8000. 

• Map into a space that is not already used by the target system. This will assure 
that mapping is not done on top of already mapped space. 

• Map as read-only. This will prevent overlay memory from being modified by a 
custom diagnostic. 

• The OVS (page 5-67) must be set to a non-zero value. This will cause overlay 
memory to provide a DTACK (DS ACK for the 68020) to the microprocessor. 
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CUSTOM DIAGNOSTICS, (com.) 



Passing Parameters to Custom Diagnostics 

Many times when writing diagnostics it may be necessary to pass parameters to those 
routines. The SF 40-49 commands do not take parameters, so you should store the 
parameters into one of the eight general range registers (GRO-7) or into one of the 
eight general data registers (GDO-7). Your custom diagnostic may then pick up the 
data or store results at the following locations: 



68000/08/10 












BEGINNING RANGE 


ENDING 


RANGE 


GR0 


$3100 




$3103 


$3104 




$3107 


GR1 


$3108 




$310B 


$310C 




$310F 


GR2 


$3110 




$3113 


$3114 




$3117 


GR3 


$3118 




$311B 


$311C 




$311F 


GR4 


$3120 




$3123 


$3124 




$3127 


GR5 


$3128 




$312B 


$312C 




$312F 


GR6 


$3130 




$3133 


$3134 




$3137 


GR7 


$3138 




$313B 


$313C 




$313F 


68020 


ONLY 












GR0 


$3200 




$3203 


$3204 




$3207 


GR1 


$3208 




$320B 


$320C 




$320F 


GR2 


$3210 




$3213 


$3214 




$3217 


GR3 


$3218 




$321B 


$321C 




$321F 


GR4 


$3220 




$3223 


$3224 




$3227 


GR5 


$3228 




$322B 


$322C 




$322F 


GR6 


$3230 




$3233 


$3234 




$3237 


GR7 


$3238 




$323B 


$323C 




$323F 
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CUSTOM DIAGNOSTICS (com.) 



68000/08/10 










DATA 






DUN 1 LAKi, DAIA 


GDO 


$3140 






9J ± *4 *i — ZfJi-l 1 


GDI 


$3148 




4 Q 1 /I'D 

9 3±Ha 


■?J±*4L. ? Jiir 


GD2 


$3150 




$3153 


$3154 - $3157 


GD3 


$3158 




$315B 


$315C - $315F 


GD4 


$3160 




$3163 


$3164 - $3167 


GD5 


$3168 




$316B 


$316C - $316F 


GD6 


$3170 




$3173 


$3174 - $3177 


GD7 


$3178 




$317B 


$317C - $317F 




68020 


ONLY 










DATA 






DON'T CARE DATA 


GDO 


$3240 




$3243 


$3244 - $3247 


GDI 


$3248 




$324B 


$324C - $324F 


GD2 


$3250 




$3253 


$3254 - $3257 


GD3 


$3258 




$325B 


$325C - $325F 


GD4 


$3260 




$3263 


$3264 - $3267 


GD5 


$3268 




$326B 


$326C - $326F 


GD6 


$3270 




$3273 


$3274 - $3277 


GD7 


$3278 




$327B 


$327C - $327F 



GR registers are 32 bits wide while ranges are only valid for the 24 bits. A custom 
diagnostic that required a range parameter and a don't care and returned a 32-bit data 
parameter might look like: 



>GR4=$1000 LEN $40;GD4=$CXFF;SF $44;GDO 



The range parameter goes into GR4; the Don't Care bit (X) goes into GD4; then the 
user diagnostic is called; and finally, the result is displayed as the content of the 
register GDO. 
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CUSTOM DIAGNOSTICS, (cont.) 



Debugging Custom Diagnostics 

A custom diagnostic may be set up to be debugged similar to debugging a program in 
target memory space. 

After a custom diagnostic is downloaded to the ES 1800 internal RAM it may be 
debugged by the following procedures: 

• Enable introspective mode with the IM software switch, page 5-21. 

• Set the SSP register to point to an area of memory that will provide a stack. This 
stack should be the top of the user RAM area (7C00 hex) in overlay memory that 
is mapped as read/write. 

If a RTS is encountered while single stepping through a routine the PC register will 
be undefined. 
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READ TARGET SYSTEM CLOCK 



Command Result 



CLK Reads the target system clock and displays 

the value in KHz, accurate to 1-2 KHz. 



Examples 



>CLK 

CLOCK FREQUENCY = #2001 KHZ 
> 
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TARGET CYCLIC REDUNDANCY CHECK 



Command 



Result 



CRC <range> 



The system calculates a cyclic redundancy 
check on all addresses in <range>. 



Comments 



These commands are valid in pause mode only. 

The CRC command generates a cyclic redundancy check value over a user denned 
address range. Only the byte mode is used for this test. 

CRC calculations can be used to determine if RAM based data is being corrupted. 
Do a CRC over the data base and save the value. Then run your program and do the 
CRC over the range again. If the values do not match, data are being corrupted. The 
Event Monitor System can be setup to catch writes to the data base. 

The CRC algorithm is based on the polynomial X16 Y 15 v 2 . 
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DISPLAY STATUS OF SEVERAL STATUS LINES 



Command Result 



BUS Displays the bus status. 



Comments 



Your console will display bus status: 
HLT Halt 

IPL Interrupt Priority Level 
RST Reset 
VCC Power 
BER Bus Error 



Examples 



The system default status is: 



HLT 


IPL 


RST 


VCC 


BER 


0 


0 


0 


0 


0 



0 indicates an inactive condition. 1 indicates an active condition. 0-7 in the IPL 
column represents the interrupt priority level encoded on the IPL lines. 
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Overview 

The ES 1800 Event Monitor System (EMS) provides extremely flexible system and 
breakpoint control, enabling the user to isolate or break on any predefined series of 
events and then perform various actions. The user controls and monitors the target 
by entering commands that define events as logical combinations of address, data, 
status, count limit, and optional Logic State Analyzer pod inputs. When an event is 
detected, the ES 1800 can break emulation, trace specific sequences, count events, 
execute user supplied target routines, and trigger a TTL output 

The ES 1800 Event Monitor System is based on a 16 bit environment. The 68020 
microprocessor consists of a 32 bit architecture. To incorporate the 68020 into the 
ES 1800 chassis, some enhancements were introduced into the emulator's operating 
system to facilitate selective tracing. 68020 tracing requirements are described in 
section 8. 

NOTE 

For systems with the dynamic trace option, the entire Event Monitor System 
is disabled while the OFF TCE command is in effect. Refer to the Dynamic 
Trace Capture Enable command in Section 5 for more information. 

WHEN/THEN control statements define events and their corresponding actions. 
There can be several actions for any event, and there can be many control statements 
in effect at any time. The Event Monitor System can also switch groups to allow for 
sequencing events. There are four event groups available and the control statements 
and comparator values for any group are independent of those in other groups. 
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Event Monitor System control statements can be entered while in run mode. The 
event comparator values can also be modified during run mode. However, these new 
statements and values will not go into effect until you stop and restart run mode. 

NOTE 

Simultaneous use of the Dynamic Trace feature and the Event monitor 
system is not possible. Refer to the Dynamic Trace Capture Enable (TCE) 
command in Section 5 for more information. 

The ES 1800 Event Monitor System monitors target information at the bus cycle 
level; i.e., every read or write cycle that the microprocessor executes. The EMS 
system detects every signal that can affect the target system. It can also monitor 
inputs from the Logic State Analyzer pod. 

The Event Monitor System essentially takes a picture of the Motorola 680XX 
microprocessor's signals at the end of every bus cycle (refer to Motorola manual, 
16 Bit Microprocessor Users Manual). The information that is recorded into trace 
memory is the same information that the EMS is monitoring. 

The Event Monitor System will only break on the address information that was 
traced. The breakpoint comparators only look at the addresses output by the 
microprocessor. For example, if the microprocessor is reading word-wide data from 
memory, odd address will not appear on the bus, and a break will not occur if the 
breakpoint is on odd address. 

The basic Event Monitor System control statement is of the form: 

[Group] VfHE[N] <event> THEfftFj <action> 

Notice that the ESL command processor needs only the first three letters of the 
symbol. 
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Comparator Registers 

An event occurs based on the value of a comparator register or a combination of 
comparator registers. Comparators can be combined with AND, OR, or NOT 
operators. The action that follows an event may be a single command or multiple 
commands separated by commas. 

There are eight comparator registers for each of the four event groups. These event 
registers are listed in the table on the following page. The address comparators are 
used to detect discrete addresses or addresses inside or outside a specified range. The 
data comparators can detect specific data patterns and can ignore specified bit 
positions. The status comparators monitor all of the status signals from the 
microprocessor as well as some generated by the ES 1800. The status comparators 
can also ignore bit positions. The count limit register can be used to detect when an 
event has occurred a specified number of times. The logic state analyzer register can 
detect bit patterns in the inputs from the Logic State Analyzer pod; the LSA 
comparator can also ignore bit positions. 



The following table describes the available event comparator registers. 



Register 




Size 


Name by Group 




Description 


Type 


(bits) 


1 


2 


3 


4 


Address 1 


Range, Integer 


24 


AC1 or AC1.1 


AC1.2 


AC1.3 


AC1 .4 


Address 2 


Range, Integer 


24 


AC 2 or AC2.1 


AC2.2 


AC2.3 


AC2.4 


Data 1 


Don't Care, Integer 


16 


DC1 or DC1.1 


DC1.2 


DC1.3 


DC1.4 


Data 2 


Don't Care, Integer 


16 


DC 2 or DC2.1 


DC2.2 


DC2.3 


DC2.4 


Status 1 


Don't Care, Integer 


16 


SI or Sl.l 


SI. 2 


SI. 3 


SI. 4 


Status 2 


Don't Care, Integer 


16 


S2 or S2.1 


S2.2 


S2.3 


S2.4 


LSA 


Don't Care, Integer 


16 


LSA or LSA.l 


LSA. 2 


LSA. 3 


LSA. 4 


Count 


Integer 


16 


CL or CL.l 


CL.2 


CL.3 


CL.4 
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Address Comparators 

Address comparators may be assigned integer values or range values. Ranges may be 
either internal (IRA) or external (XRA). If a range is specified without IRA or XRA 
operators, the default range type will be IRA. The following are examples of valid 
address comparator assignments. 



>AC1=2000 
>AC2=1000 LEN 20 
>AC2.2=XRA 1100 TO 1250 
>AC1.4 = IRA $FF006 LEN $FF 
>AC1.1 = Al 
>AC2=' Symbol 
>AC1 =PC + 200 
>AC1.2 = IAC1.4 



Data and LSA Comparators 

The data comparators monitor the data bus for specified patterns. The LSA 
comparators monitor the input pulses from the Logic State Analyzer pod- 
Data and LSA comparators may be assigned integer values or don't care values. 
Don't care values may be assigned in two ways. The first is to specify the value 
followed by the don't care mask; the second is to specify the value using X in the 
don't care positions. The following are examples of valid data and LSA comparator 
assignments. 



>DC1=237F 

>LSA=5300 DC $FF 

>LSA.3 = 53XX 

>LSA = %110101 DC $FF00 

>DC2.2 = 42 DC %101 

>DC2 = GD0 + $F 

>DC1.4 = 8'data table + 56 
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Status Comparators 

The status comparators are assigned values from the list of status constants. Many of 
these constants can be combined to specify a complex comparator value. The 
following list shows the available mnemonics. Any of these statuses can cause 
events. 







BER 


bus error 


VM 


valid memory address 


VP 


valid peripheral address 


IP (0-7) 


interrupt levels 0—7 


SP 


supervisor program 


SD 


supervisor data 


UP 


user program 


CPU 


CPU space 


SC (0-7) * 


numeric names for all 8 space codes* 


TAR 


target system access 


OVL 


overlay memory access 


RD 


read access 


WR 


write access 


BYT 


byte access 


WRD 


word access 


* SCO, SC3, SC4 are 


used only by 68010 and 68020. 
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The following status mnemonic table shows which status values can be assigned to 
the comparators. You may assign a status comparator a single mnemonic, or you may 
combine a mnemonic from each of the columns 2-9. Mnemonics are combined using 
an addition operator (+) as a Boolean AND. 









STATUS MNEMONIC TABLE 




1 


2 


3 


4 


5 6 7 8 


9 


SI 


= BYT 


+ RD + 


TAR 


+ SCO + BER + IPO + VM + 


VP 


S2 


WRD 


WR 


OVL 


SC1/UD IPI 












SC2/UP IP2 












SC3 IP3 












SC4 IP4 












SC5/SD IP5 












SC6/SP IP 6 












SC7/CPU IP 7 





Some examples of status comparator assignments: 



>S1=BYT 

>S2=IP7+SD 

>S1.2=OVL+BER 



When you assign a status comparator value using the status mnemonics, the ES 1800 
automatically sets the appropriate don't care mask. In the following example, status 
comparator 1 is assigned the RD (read) mnemonic. When you type SI, the numeric 
value of the comparator is displayed. The Read bit is in bit position 1, so all of the 
other bits have been masked. The status comparator does not care what values are set 
in the other 15 bits of the comparator. 



>S1 = RD 
>S1 

$00000002 DC $0000FFFD 
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In the next example, all bits except bits 1, 2, 9, 10 and 11 are masked. These bits are 
enabled (Is or 0s) and should be considered. 



>S1 = IP7 + RD + TAR; SI 
$00000E06 DC 0000FIF9 



When you display the value of the status comparators, you will see don't care values 
rather than the mnemonics you originally assigned. The status comparator breakdown 
table is provided to aid you in decoding the numbers back into mnemonics. 



7-7 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 





blAlUo ^UrarAKAXUK dK&AISXJUWN 








Id 1 •) 


19 11 Ifl Q P 1 R A 

J-iC XX XU o / D D *i J 


2 


i 


Q 


1 1 


1 \ 1 / 1 \ 1 / 


1 


l 
1 


1 


1=VM 1=VP 


0=IP0 1=BER 0=SC0 0= 


OVL 


| 


| 




1=IP1 1=SC1/UD 1= 


TAR 


1 


1 




2=IP2 2=SC2/UP 


0 


=WR 


1 




3=IP3 3=SC3 


1 


=RD 


1 




4=IP4 4=SC4 




0 


=WRD 




5=IP5 5=SC5/SD 




1 


=BYT 




6=IP6 6=SC6/SP 










7=IP7 7=SC7/CPU 










olAlUo ^UlYLrArvfilUK 13X1 Kiir KIjOIjJN l/il 1UJN 










nnnn Anno nr* Tai^Tru 1 

VM— UUUU1UUU UK, Hr r r 










vr- UUUU^UUU UK, Ur r r 










XlrU — UUUUUUUU Dt, ftlt 










XFX— UUUUUZUU Dt- rift 










XF^=UUUUU4UU DC FlFt 










XFJ— UUUU U bU U UK, r Xr fc 










XFfl = UUUUUoUU Ut- r Xr r 










Xlr O — U U U U UAU U UK, r Xr r 










lrb-UUUUUL.UU Dl~ r Xr r 










Xlr / — U U U U UHiU U r Xr r 










rSHiK— U U U U U X U U UK, rCitr 










bLU-UUUUUUUU 1J\- r r or 










i3l_X/ UL)— UUUUUUXU UK, r r or 










bL^/ UF=UUUUUU^U DO flol 










SC3=00000030 DC FF8F 










SC4=00000040 DC FF8F 










SC5/SD=00000050 DC FF8F 










SC6/SP=00000060 DC FF8F 










SC7/CPU=00000070 DC FF8F 










TAR=00000004 DC FFFB 










OVL=00000000 DC FFFB 










RD=00000002 DC FFFD 










WR=00000000 DC FFFD 










BYT=00000001 DC FFFE 










WRD=00000000 DC FFFE 









The don't care mask is the value to the right of DC. A zero in a mask bit position 
enables the status bit in the same position on the left side of the DC, and '1' in a 
mask bit position masks or disables the corresponding bit on the left side of the DC. 

Determine which bit positions are unmasked (those containing Os in the mask value). 
It may be easier to do this by setting the status comparator's display base to binary 
(BAS SI = 2). Then refer to the status comparator breakdown table and find the 
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unmasked bit positions. Look at the value contained on the left side of the DC and 
match it with the corresponding value shown underneath the bit position in the table. 



>si 

$00000E06 DC 0000F1F9 



All bits except bits 1, 2, 9, 10 and 1 1 are masked. Bits 9, 10, and 1 1 are enabled and a 
7 in these three bits of the status value indicates IP7 was entered. 

Bit 1 is enabled and there is a 1 in bit 1. So RD was entered. 

Bit 2 is enabled and there is a 1 in bit 2 of the status value so TAR was entered. 

Therefore, the original input was: 



>S1=IP7+RD+TAR 



Count Limit Comparator 

The count limit comparator CL, is used to detect when events have occurred a certain 
number of times. When you enter run mode, the CL value for group 1 is loaded into 
a hardware counter which is decremented whenever the CNT action is executed (see 
the sections on Defining Events and Action Lists). If a group switch occurs, the 
hardware counter can be loaded with the new group's count limit by executing the 
RCT (reset count) action. Otherwise, the hardware counter will not change its limit 
value when switching groups. 
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Defining Events 

The Event Monitor System is arranged in four independent groups. These groups 
provide a state-machine capability for debugging difficult problems. EMS control 
statements are associated with one of the four groups. If no group numbers are 
mentioned in the EMS control statement, the statement will be assigned to group 1. 
There are two ways to override this default selection of group 1. You can begin the 
EMS control statement with a group number, or you can add a group number to any 
one of the event comparator names. For example: 3 WHEN AC1 THEN BRK is 
functionally the same as WHEN AC1.3 THEN BRK. You cannot mix group 
numbers within a single EMS control statement. 

Event 

You can define an event to be some combination of address, data, status, count and 
Logic State Analyzer pod conditions. Numerous Event Monitor System control 
statements can be entered and will all be in effect simultaneously. The ES 1800 will 
attempt to resolve conflicting statements, but conflicts may cause unpredictable 
action processing. Parentheses are not allowed in event specifications. 

The NOT operator is used to reverse the sense of the comparator output NOT has 
higher precedence than either of the conjunctives. 

WHEN AC1 AND NOT DC1 THEN BRK 

means break whenever any data pattern other than that in DO occurs on the bus 
along with AC1. 

AND and OR can be used where needed to form more restrictive event definitions. 
AND terms have hig her prec eden ce than OR terms. AC1 AND DC1 OR DC2 is 
the same as AC1 AND DC1 in one statement and DC2 in another. If you are 
looking for two different data values at an address, use 

WHEN ACl AND DC1 OR AC1 AND DC2 THEN... 
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The OR operator is evaluated left to right and is useful for simple comparator 
combinations. For complex event specifications, OR combinations can be replaced 
with separate EMS control statements for clarity. 

WHEN AC1 AND SI OR AC2 AND S2 THEN... 

is the same as 

WHEN AC1 AND SI THEN. . . 

and 

WHEN AC2 AND S2 THEN. . . 
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Defining Action Lists 

The action list in a WHEN/THEN statement defines what the ES 1800 does when an 
event is detected. Actions are specified in an action list separated by commas. The 
action list may have one or more actions defined. 



Examples 



<group> WHEN <event> THEN <action> ,<action> , ... ,<action> 
The following table lists all possible actions. 



Event 


Monitor System Actions 


Action 


Description 


BRK 


Break emulation 


CNT 


Count Bus Cycle 


FSI 


Force Special Interrupt 


GRO n 


Change Event Group 


RCT 


Load Count Value 


TGR 


Output Trigger Signal 


TOC 


Toggle Count State 


TOT 


Toggle Trace State 


TRC 


Trace Bus Cycle 



The TRC and TOT actions are described in the Tracing Events section. The CNT, 
RCT, and TOC actions are described in the Counting Events section. The FSI action 
is described in the Special Interrupt section. The GRO action is described in the 
Changing Event Groups section. The TGR action is described in the Trigger Signal 
section. The BRK is described in the Breaking Emulation section. 
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The EMS will always resolve conflicting EMS action statements. In the following 
example, the TOC action in the first statement will be changed to CNT. 



>WHEN 


AC1 


THEN 


TOC 


>WHEN 


AC1 


THEN 


CNT 
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Command Result 



DES 

DES < group number> 



Displays all of the WHEN/THEN 
statements currently active from all 
groups. 

Displays all of the WHEN/THEN 
statements and the comparator values for 
the specified group. 
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Examples 



Display the statements and comparators for groups 1 and 2. 



>DES 1;DES 2 

1 WHEN AC1 THEN BRK 
AC1.1 = $007632 
AC2.1 = $000000 
DC1.1 = $0000 
DC2.1 = $0000 

51 .1 = $0000 

52 .1 = $0000 
LSA.l = $0000 
CL .1 = $0000 

2 WHEN SI AND DC1 THEN CNT, TRC 
2 WHEN CL THEN BRK 

AC1.2 = $000000 
AC2.2 = $000000 
DC1.2 = $40FF DC $00FF 
DC2.2 = $0000 

51 .2 = $0003 DC $FFFC 

52 .2 = $0000 
LSA.2 = $0000 
CL .2 = $0010 
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CLEAR WHEN/THEN STATEMENTS 



Command Result 



CES Clears all of the WHEN/THEN statements 

currently active. 

CES <group number> Clears all of the WHEN/THEN statements 

for the specified group. 



Comments 



The comparator values are not affected by the CES command. 
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Breaking Emulation 

The BRK action stops emulation, returning the system to pause mode. When a break 
event is detected and emulation has been broken, the current PC and event group is 
displayed on the terminal. When you enter run mode or execute a single step, 
emulation begins at the value contained in the current PC. When entering emulation, 
the Event Monitor System always begins looking for events specified in group 1. 

Breakpoints stop program execution at specific times. After a break you can 
disassemble the trace memory, look at the LS A bits in the raw trace, check the CPU 
register values, or begin stepping through your code. 

Breakpoint actions may be enabled or disabled by selecting the appropriate run 
commands. If you enter emulation with the RBK or RBV run commands, breakpoints 
are enabled. If you enter emulation with the RUN or RNV commands, breakpoints 
are disabled, even if there are event statements specifying the BRK action. If 
emulation is entered with breakpoints disabled, you can enable them while running 
by entering the RBK command. If you enter emulation with breakpoints enabled, you 
can disable them while running by entering the RUN command. The RNV and RBV 
commands are not allowed during emulation. These commands load the reset vectors 
before entering emulation. Vectors cannot be loaded during emulation. 

Emulation may be halted using the STP command. The reset character also breaks 
emulation. The default reset character is A Z. You can change this using the SET 
command, option 2. 



Examples 



Break when address $3000 is accessed. 



>AC1=3000 

>WHEN AC1 THEN BRK 

>RBK 

R> 



Trace only accesses between 1000 and 113C. Break after ten accesses to this address 
range. 
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>AC1=1000 to 113C 
>CL =#10 

>WHEN AC1 THEN CNT, TRC 
>WHEN CL THEN BRK 
>RBV 
R> 



Break when 55AA is written to port A. 



>AC1='P0RT_A 

>DC1=55AA 

>S1=WR 

>WHEN AC1 AND DCl AND Si THEN BRK 

>RBK 

R> 



The 68008 uses an 8 bit data field. The emulator traces this information in a 16 bit 
field where the high and low positions are dependent on it being an even or odd 
address. 

To break on an 8 bit data field use the following example: 



>DC1 = 55XX 
>DC2 = 0XX55 

>WHEN DCl OR DC2 THEN BRK 

>RBK 

R> 
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Events : 

TRC 
TOT 



The Event Monitor System can be set up to trace bus cycles selectively. If all of the 
conditions specified in the event portion of the WHEN/THEN clause are satisfied, the 
trace action, TRC, causes the specified bus cycle to be recorded into the trace 
memory. 

The toggle trace, TOT, provides a way to turn tracing on and off. When a TOT event 
is detected, the trace is toggled to the opposite state, either on or off. You can specify 
a single event that starts and stops trace each time it is detected or specify any 
number of events that toggle trace on and off. 

If there are no event actions that specify TRC or TOT, all bus cycles are traced. If 
there is a TRC event, only qualified bus cycles are traced. If there is a TOT event, 
trace will be off until the TOT is detected, then all bus cycles are traced until 
encountering another TOT event 

Refer to the tables on page 7-28 in the Changing Event Groups section to see the 
effects of group changes on trace actions. 
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Examples 



Trace only a specific subroutine. Break at the end of the routine. 



>AC1=' 


Sub_ 


start to 'Sub end 


>AC2 = 


Sub_ 


end 


>WHEN 


AC1 


THEN TRC 


>WHEN 


AC 2 


THEN BRK 


>RBK 






R> 







In the example below, the WHEN LSA THEN TOT command statement is used to 
turn on trace when a specific hardware event occurs and turn off trace when the 
activity is terminated. 

Two event groups are required to specify special on and off points. 
1. Identify the logical state analyzer addresses: 



>LSA 


1 = 


$0000 


DC 


$FFFE 


>LSA 


2 = 


$0001 


DC 


$FFFE 



This sets up the LSA comparator to a specific address. 

2. Set up WHEN/THEN statements to monitor activity that the microprocessor 
can not directly see, i.e. inputs you have connected to the LSA probe. 

>WHEN LSA THEN TOT, GRO 2 
>WHEN LSA. 2 THEN BRK 

The emulator waits for the Logic State Analyzer bit 0 to go low. When it does, 
the toggle trace command (TOT) turns on trace memory and switches the 
event system to group 2. In group 2, all bus cycles are traced until LSA pod bit 
0 goes high. Then, emulation is broken. 
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Registers : 

Value Type - 16 bit integer 

CL 

CL. 1 
CL.2 
CL.3 
CL.4 

CL=<EXP> 

CL< . group>=<EXP> 

Events : 

CNT 
RCT 
TOC 



Events can be defined to count bus cycles selectively. There is one hardware counter 
and there are four count limit registers, one register for each group. When you enter 
run mode, the hardware counter is automatically loaded with the count limit register 
value for group 1. 

The count, CNT, action decrements the hardware counter. When the count reaches 
zero, the CL event becomes true. If all other conditions specified in the 
WHEN/THEN clause are satisfied, the appropriate action is taken. 

Whenever the reset count, RCT, action is specified, the count comparator value for 
the specified group is loaded into the hardware counter. When switching groups, the 
current value of the hardware counter is passed along as a global count value unless a 
RCT action is specified in the same list of events that causes the group switch. 

The toggle count, TOC, command provides a way to turn counting on and off. When 
a TOC event is detected, the count is toggled to the opposite state, either on or off. 
You can specify an event that starts and stops the counter each time it is detected or 
specify any number of events that toggle the counter on and off 

The current value of the counter cannot be read. You can only detect when you have 
reached a limit. 
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Refer to the tables on page 7-29 in the Changing Event Groups section to see the 
effects of group changes on count actions. 



Examples 



Count the times that the specified data are written to a specific address. Break if the 
data are written 20 times. 



>CL=#20 
>S1=WR 

>ACl=4020; DCl=$XXF3 

>WHEN AC1 AND DC1 AND Si THEN CNT 

>WHEN CL THEN BRK 

>RBK 

R> 



To cause a break to occur after $400 writes have lapsed: 



>S1 = 


WR 




>CL = 


400 




>WHEN 


SI THEN 


CNT 


>WHEN 


CL THEN 


BRK 


>RBK 






R> 
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In the following example, the Event Monitor System is used to trace cycles before 
and after an event has occurred. You can adjust the number of cycles traced before 
or after the event to create the window you need. 

Look for a read from a specific I/O port After it is found, switch to group 2 and load 
the group 2 count limit value into the hardware counter. In group 2, use an address 
comparator to count every bus cycle (all addresses). Break after 100 bus cycles have 
been executed. 



>AC1=' IOport 
>S1=RD 

>WHEN AC1 AND Si THEN GRO 2, RCT 

>CL.2=#100 

>AC1.2=0 TO -1 

>2 WHEN AC1 THEN CNT 

>2 WHEN CL THEN BRK 

>RBK 

R> 



To switch groups and set a new count limit value: 



>AC1=1024 

>WHE AC1 THE GRO 2, RCT 

>CL.2=15 

>AC1. 2=3068 

>2 WHE AC1 THE CNT 

>2 WHE CL THE BRK 

>PC=@4;RBK 
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Trigger Signal 

The trigger signal is an output that is available from the BNC connector labelled 
TRIG on the back panel of the ES 1800 chassis and from pin 19 of the optional LSA 
pod. When a TGR event is detected, the trigger signal is asserted, and remains so for 
the duration of the specified bus cycle. If a trigger event is specified for more than 
one consecutive bus cycle, the signal stays high for the duration of the consecutive 
bus cycles. 

The trigger signal can be used as a pulse output for triggering other diagnostic 
equipment. It can also be used in conjunction with a counter/timer for timing 
subroutines. 



Examples 



Trigger a scope when reading data from a UART. 



>AC1=' DATA_PORT 
>S1=RD 

>WHEN AC1 AND SI THEN TGR 
>RUN 



Determine the duration of a subroutine using the trigger pulse. The trigger pulse can 
be the input to a counter/timer or a scope. The duration of the subroutine can be 
determined from the pulse width displayed on the scope or the counter/timer readout. 



>AC1=2500 


Start of subroutine 


>AC1.2=AC1+38E 


End of subroutine 


>DC1.2=0XXXX 


Detect any data pattern 


>WHEN AC1 THEN TGR, GRO 2 


Go to group 2 when subroutine is entered 


>2 WHEN DC1 THEN TGR 


Trigger during all cycles while in group 2 


>2 WHEN AC1 THEN GRO 1 


Go back to group 1 when last instruction 


>RUN 


in subroutine is executed. 


R> 
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Special Interrupts 


Registers : 




SIA 


Value Type - 32 Bit Integer 


Events : 




FSI 





The force special interrupt action, FSI, provides a way to jump to a specified address 
when a specific event is detected. 



The special interrupt address register, SIA, should be set prior to entering run mode if 
you are using the FSI event. It defines the address your program vectors to when the 
FSI is executed. 

When an FSI event is detected, an FSI ACTIVE message is displayed on the 
screen. You may also see some unusual cycles in the trace memory at the address 
where the FSI occurred. These are internal cycles that get traced as the execution 
address is changed. They are not purged from the trace memory because of the need 
for speed when executing an FSI. 

The FSI event can be used as a fast way to make a patch to your code. It is also used 
to write soft shutdown routines for machinery that cannot be halted using a simple 
breakpoint 

The FSI routine residing at the SIA address should terminate with a return from 
exception (RTE) instruction. Execution will resume at the address immediately 
following the instruction that caused the FSI. If this is a soft shutdown, you will 
probably define a breakpoint at the RTE instruction. 
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Examples 



Make a patch using overlay memory. 



>MAP 1000 






>AC1=8F36 






>WHEN AC1 THEN FSI 






>SIA=1000 






>ASM SIA 


Single 


line assembler - patch code 




can be 


assembled here. 


>RUN 






R> 







Assume the program needs to break at a certain address, but the machine cannot be 
turned off until a soft shutdown routine is executed. Set SIA to the address of the soft 
shutdown routine. Use an FSI action at the break address, then set a breakpoint at the 
end of the soft shutdown routine. 



>SIA=' shut_down 

>AC1=$7F4E2 

>AC2=' shut_down + 4E 

>WHEN AC1 THEN FSI 

>WHEN AC 2 THEN BRK 

>RBK 

R> 
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Changing Event Groups 

The four event groups provide a way to detect sequential events. When emulation is 
entered, event monitoring always begins in group 1. The example below describes a 
common use of the EMS group structure. 

You may wish to trace a subroutine after it has been called by module A or module B, 
but not if it has been called from modules C, D, or E. In this case, you would define 
the address comparators in group 1 to the address ranges of modules A and B. When 
either of these modules is encountered, switch to group 2 and look for the subroutine. 
After tracing the subroutine, switch back to group 1. 



>'Module_A =1240 LEN 246 
>'Module_B =8750 LEN 408 
>'Sub_X =8 934 LEN 56 

>ACl='Module_A 
>AC2='Module_B 

>WHE AC1 OR AC 2 THE GRO 2 

>AC1.2=' Sub_X 

>2 WHEN AC1 THE TRC 

>2 WHE NOT AC1 THE GRO 1 
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When switching between groups, pay special attention to the condition of the trace 
toggle actions. The TRC/TOT action interacts in a specific way when event groups 
are switched. The following state transition table describes the effects of various 
group changes on trace actions: 



Previous 
Group 


New Group 


Nothing 
Specified 


TRC 


TOT 


Nothing 
specified 


Trace all 
cycles 


Trace only 
qualified cycles 


Trace all cycles 
until first TOT 


TRC 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT OFF 
(not tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT ON 
(tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


Trace all cycles 
until first TOT 



The following table summarizes the initial trace conditions (always group 1). 



Action Specified 


Trace Condition 


Nothing 
TRC 
TOT 


Trace all cycles 
Trace only qualified TRC events 
Trace nothing until TOT event 
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When switching between groups, pay special attention to the condition of the count 
toggle actions. The CNT/TOC actions interact in a specific way when event groups 
are switched. The following state transition table describes the effects of group 
changes on count actions. 



Previous 
Group 


New Group 


Nothing 
Specified 


CNT 


TOC 


Nothing 
specified 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


CNT 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC OFF 
(not counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC ON 
(counting) 


No cycles 
counted 


Count only 
qualified cycles 


Count all cycles 
until first TOC 



This table describes initial count conditions (always group 1). 



Action Specified 


Count Condition 


Nothing 
CNT 
TOC 


No cycles counted 
Count only qualified CNT events 
Count nothing until TOC event. 
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Time Stamp Module 

This section describes what the Time Stamp Module does and how to install and use 
the module. Complete examples are provided for using the module to do each 
possible type of measurement 

The Time Stamp Module adds performance analysis to the ES 1800. You can use this 
module when you use your ES 1800 from a dumb terminal or host computer, or from 
your host computer using ES Driver control software. Differences in operation for 
these two configurations are noted where appropriate. 

There are two ways the module can be used: 

1 . To measure elapsed or absolute time. 

2. To trigger the Event Monitor System to cause an action such as breaking 
emulation once a time stamp counter value is reached. 



Commands Used to Set Up Time Stamp 


Command 


Description 


Page 


SET #9 


Choose timestamp or LS A 


7-36 


CTS 


Convert timestamp value 


5-136, 7-60 


WHEN 


Event monitor system statements 


7-40 



Possible Measurements 

There are eight distinct measurements that can be made using the Time Stamp 
Module: 

Elapsed Time Measurements 

— Measure time spent in a module 

— Measure time spent between modules 

— Measure duration of time when memory is accessed (opcode or data) 

— Measure duration of time when code is accessed (opcode only) 

— Measure interrupt response time directly 
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Count Occurrences 

— Count number of times address or range of memory is accessed (opcode or 
data) 

— Count number of times code is accessed (opcode only) 

— Count module linkage activity (the number of times one module calls another) 

Each time measurement can be based on one of five scales: .luS, luS, .OlmS, .lmS or 
lmS, so you can collect your data using the appropriate time scale. The maximum 
number of counts for any time base is 65,535 so you have a maximum period of 65 
seconds without overflow. 

Time can be measured on an absolute time frame, or on a relative time frame. When 
you use the absolute time frame, the measurement is from when the counter is reset. 
When you use the relative time frame, the measurement is from one traced cycle to 
the next traced cycle. For example, if you were measuring the elapsed time for 
entering and exiting a module, the time displays would show as follows: 



t The first line on the relative trace screen shows the absolute count. 

Using the Time Stamp Counter Value as a Condition 

The ES 1800 Event Monitor System lets you specify complex program states, using 
WHEN-THEN statements: 

WHEN conditions THEN actions 

You can use the absolute value of the time stamp counter as one condition. For more 
details on using CTS, see the example on page 7-60, and the Miscellaneous 
Commands section, page 5-136 



Absolute Relative 



enter 

exit 

enter 

exit 

enter 

exit 



3000 3000f 



3005 5 

3007 2 

3012 5 

3014 2 

3019 5 
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Installation 

Hardware Installation 

The Time Stamp Module consists of the module and the cable to connect it to the 
emulator. 

There are three steps to hardware installation: 

1. Turn the emulator off. 

CAUTION 

The ES 1800 emulator must be off before plugging in the Time Stamp 
Module, or the cable and module may be damaged. Do not plug in or 
unplug the Time Stamp Module with power turned on. 

2. Connect the module to the LSA port on the front of the ES 1800 emulator as 
shown in the following illustration. Note that you cannot use the Logic State 
Analysis pod and the Time Stamp Module at the same time. 

Figure 7-1. Connecting the Time Stamp Module to the ES 1800 
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3. The Time Stamp Module requires a certain revision of ESL (Emulator 
Standard Language). To check your revision: 

ESL command Type REV from the ES 1800 prompt 

from ES Driver Enter the Target Emulation menu, and type 

REV from the ES 1800 prompt 

If you have an ESL revision number equal to or greater than that shown in the 
chart below, you can use your Time Stamp Module as is. If your ESL version is 
below the revision shown below, please contact your local sales office or 
representative, or call the Order Administration department at 800-426-3925 
for information on upgrading your ESL revision. 



Product 


Minimum Revision Level 


68000/08 
68010 


ESL 3.3 
ESL2.5 



Software Installation 

No software changes are required to operate the Time Stamp Module for any of the 
following software packages available from Applied Microsystems Corporation. 

• ES Driver 

• VALID ATE/XEL 
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Using the Time Stamp Module 

This section explains the meaning of the labels, buttons, switches and LEDs on the 
Time Stamp Module, and then provides complete information on how the unit works. 

Figure 7-2. Time Stamp Module 




Getting Started 

Look at the end of your Time Stamp Module and identify the trigger inputs, reset 
button, switch and overflow indicator LED as shown in the following diagram. 

Figure 7-3. End View of Time Stamp Module 



switch 



is 



TGR TGR RST O/F 
* c — trigger inputs 1 — resat button > overflow light 



TGR The TGR input is used to measure interrupt latency directly. You 
connect the TGR input directly to the interrupt line in your target circuit, 
avoiding any logic delays due to use of the Event Monitor System. It is 
designed for processors that pull lines low for interrupts (Motorola 
processors). 



7-34 



68000/08/10 Event Monitor System 



TGR The TGR input is used to measure interrupt latency directly. You 
connect the TGR input directly to the interrupt line in your target circuit, 
avoiding any logic delays due to use of the Event Monitor System. It is 
designed for processors that pull lines high for interrupts (Intel 
processors). 

RST The reset button is used to reset the time stamp counter to 0. 

Switch The switch is used to determine the time base and the type of counting 
done (see page 7-37). 

O/F The overflow LED is lit when the counter overflows the 65,535 limit. 

The examples of each type of measurement give complete information on when to 
use the manual reset button, TGR and TGR, and how to use the switch to choose the 
time stamp mode and time base. 

CAUTION 

Do not plug in or unplug the Time Stamp Module when power is turned on 
to the emulator. 
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Steps for Using the Time Stamp Module 

In order to make a measurement, there are seven steps you must follow: 

1. Set the ESL soft-switch 9 to the appropriate position for 
the measurement you want to make. 

2. Choose a switch setting on the Time Stamp Module. 

3. Set up your trigger inputs. 

4. Set up the Event Monitor System to trigger the Time Stamp Module 
at the appropriate program states. 

5. Run your program. 

6. View the time stamp information. 

7. Interpret the time stamp information. 

Each step is described in detail below. 
Step 1 : Set ESL Soft-Switch 9 

ESL soft-switch 9 controls the LSA display of information coming in on the LSA 
port. Settings 1 and 2 are used with the Time Stamp Module. Setting 0 is used when 
you use the LSA pod. 

0 Default: LSA value shown as 16 bits 

1 Display the absolute time value 

2 Display the relative time value 

Absolute time values are used when you want to measure the total amount of time 
spent or the number of occurrences. Relative time values are used when you are 
interested in the time spent between points A and B in your code, but are not 
interested in how long it takes to get to point A. 

To view ESL soft-switch 9: 

ESL commands Type SET. 

from ES Driver Select Target Emulation mode, and type SET. 

To set ESL soft-switch 9: 

ESL commands Type SET 9, n, where n is 0, 1 or 2. 

from ES Driver Select Target Emulation mode, and type SET 9, n, 

where n is 0, 1 or 2. 
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Step 2. Set Time Stamp Module Switch 

Choose a switch setting on your Time Stamp Module based on your measurement 
type and preferred time base. We recommend starting with the slowest time frame: 1 
mS. The table below shows the maximum measurable time period for each switch 
setting. 



Time Base 


Maximum Measurable Time Period 


0.1 uS 


6.5 milliseconds 


1.0 uS 


65 milliseconds 


.01 mS 


.65 second 


0.1 mS 


6.5 seconds 


1.0 mS 


65 seconds 



IMPORTANT 

If the counter overflows, the yellow overflow LED will be lit. Check to see if 
you are using the correct time base for the duration of your measurements. 
When the counter overflows the 65355 limit, it starts again at 0. 

When the emulator is paused, no TGR is generated by the Event Monitor 
System in positions 0-4, so the counter is not reset and is likely to overflow. 
This is not a problem. 

For example, the DRT display might be as follows. The highlighted counter value in 
the last line of the example shows the counter overflow. 



LINE 


ADDRESS 


DATA 


R/W 




FC 


ipl 


ABSHME 


#20 


000344> 


E2FD 


R 


TAR 


SP 


0 


#63590 


#19 


000346> 


80F9 


R 


TAR 


SP 


0 


#64592 


#18 


000342> 


754B 


R 


TAR 


SP 


0 


#65032 


#17 


000344> 


E2FD 


R 


TAR 


SP 


0 


#01222 
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The following table summarizes the switch positions. 



The trigger to start and stop the counter in the Time Stamp Module is either the TGR 
signal from the Event Monitor System (Step 4), or the TGR or TGR direct input from 
your target interrupt line (Step 3). 



Position 


Time 
Base 


Effect of TGR 
on Time Stamp Counter 


Useful 
Measurements 


0 
1 

2 
3 
4 


.luS 
luS 
.01 mS 
.ImS 
ImS 


Any active TGR 1 causes the time stamp 
counter to be reset to 0. No manual reset is 
required in this mode for either absolute or 
relative time stamping. 


Elapsed time 


5 
6 
7 
8 
9 


.luS 
luS 
.01 mS 
.ImS 
ImS 


While the TGR is held active by the Event 
Monitor System, the time stamp counter 
counts. Manual reset is required in this 
mode for absolute time stamping, but not for 
relative time stamping. 


Elapsed time 


A 
B 
C 
D 
E 


.luS 
luS 
.01 mS 
.1 mS 
ImS 


In this mode, a long TGR signal from the 
Event Monitor System resets the counter. 
After that, successive short TGR signals 
turn the counter on and oft Manual reset 
stops the counter and sets it to zero. 


Elapsed time 


F 


n.a. 


This setting is used to count occurrences. 
Each time the TGR signal goes active, the 
time stamp counter is incremented. Manual 
reset is required. 


Count 
occurrences 



1 An active trigger refers to a high TGR signal from the Event Monitor System, a high TGR 
input, or a low TGR ir put. 



2 A long TGR is defined as being longer than 1.6 uS. This is the only mode where the length of 
the TGR matters. The following diagram shows what happens to the counter depending on the 
TGR signal. 
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Figure 7-4. Positions A-E: Effects of Multiple TGR Signals 



1.6 us 



-m m —r 



count=n count=0 counting stop counting stop 

counting counting 
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Step 3. Set Up TGR Input 

The counter in the Time Stamp Module can be controlled in one of three ways: 

1 . The Event Monitor System TGR action. 

2. The TGR input. 

3. The TGR input. 

The default is the Event Monitor System trigger input. No additional wires are 
necessary. 

To use the TGR and TGR lines to measure interrupt latency, you must connect one of 
these lines to an interrupt line on your target. (See the example on page 7-50.) The 
table on page 7-38 also contains information on the external TGR and TGR inputs. 

Step 4. Set up the Event Monitor System 

In this step, you set up the Event Monitor System to selectively trace the memory, 
program activity, or modules you are interested in time stamping. Setting up the 
Event Monitor System can be done through ESL or through the Target Emulation 
menu in ES Driver. 

There are three steps to setting up the Event Monitor System: 

1. Decide what condition you want to look at, and what actions to 
take when that condition is reached. 

2. Set up the comparators to isolate that condition. 

3. Set up WHEN/THEN statements using the appropriate 
conditions and actions. 

For more information on using the Event Monitor System, refer to the first half of this 
chapter. Examples for using the Event Monitor System to specify conditions 
appropriate for time stamping begin on page 7-43. 
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Step 5. Run your Program 

ESL commands 

from ES Driver 



Run the program using the RUN command, or run 
to a breakpoint using RBK. 

Select Target Emulation mode and use the Run 
command or run to a breakpoint using RBK. 



Step 6. View Time Stamp Information 

There are several ways to display the time stamp information. 

ESL commands The first step is to stop recording trace information 

by either: 

- stopping emulation with the STP command 

- using the Event Monitor System to break emulation 

- if you have Dynamic Trace available, you can 
use the OFF TCE command to view the trace 
while your program is still running 

Then view the trace, using the DRT command. 
The last column shows the absolute or relative time 
stamp, depending on the position you specified 
with the SET command. 

from ES Driver Enter the Target Emulation menu, and do the same 

commands as listed in stand-alone mode. 



Step 7. Interpret Time Stamp Information 

The time stamp information is always given as a number of units: the units are the 
ones you specify when you set the switch on the Time Stamp Module. 

IMPORTANT 

You must multiply this number by the time base you selected on the Time 
Stamp Module switch in order to determine the elapsed time in seconds. 
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Collecting Time Stamp Information in a File Using ES Driver 

After setting up your Event Monitor System and Time Stamp Module to provide just 
the information you need, you can use ES Driver to save the specific DRT displays to 
an ASCII file. Once the information is stored in the file, you can use a spreadsheet or 
data base management program to analyze the data- 
While in Target Emulation mode, 

1. Press <F3> to open a file to save the session record in. You will be prompted to 
enter a file name. The default extension for this file is .rec. 

2. Run the DRT command to print the trace. It will appear on the screen, and also 
be stored in the file. Note the prompt on the bottom of the screen 
"SAVE filexec <F8>=close. " 

3. Press <F8> to close the session record file. 
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Examples 

There are two basic measurement modes: Elapsed Time and Counting Occurrences. 
The examples are organized as follows: 

Measuring elapsed time 

- measuring the time it takes to go from event A to event B 

- measuring the time the program is in the specified range 

- measuring the time between an interrupt and interrupt servicing 

Counting occurrences 

- counting the number of times the program transitions 
from event A to event B 

- counting the number of accesses to a memory location or range 



Measuring Elapsed Time 

The elapsed time measurement can be used to measure in-module time, out-of- 
module time, inter-module time, and memory and program access time. These 
measurements use switch positions 0 to E. 

Conceptually, there are three types of elapsed time measurements: 

1 . Measuring the time from event "A" to event "B" 

- used for measuring program time, out-of-module execution time, 
and inter-module execution time 

2. Measuring the time spent in an address range 

- used for measuring memory time and program time (excluding 
calls to other modules) 

3. Measuring the time between an interrupt and interrupt servicing 

- used for measuring interrupt latency 
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A to B Mode 

To measure the time it takes a program to get from event "A" to event "B," the easiest 
way is to set up the Event Monitor System so only event "B" appears in the trace 
display. 

Step 1. SetLSA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use positions 0-4, depending on your preferred time base. In positions 0-4, the 
TGR from the Event Monitor System resets the time stamp counter to 0. 

If you're not sure which time base to use, use position 4 for the slowest. If the 
counter overflows, the yellow overflow LED will light. See page 7-37 for a chart 
of maximum time periods per setting. 

Step 3. Set up the Trigger Input 

To measure elapsed time, use the Event System Trigger input. No additional 
connections to the Time Stamp module are needed. 

Step 4. Set up the Event Monitor System 

AC1 = 'a Specify address comparator 1 in group 1 to be 

event A 

AC2 = 'b Specify address comparator 2 in group 1 to be 

event B 

WHEN AC1 THEN TGR The TGR action resets the time stamp counter 

to 0 at event A 

WHEN AC2 THEN TRC Trace event B 
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Step 5. Run your Program 

ESL commands RUN Run program 

from ES Driver Target Emulation Menu Run 

Stop Emulation or turn OFF TCE (Dynamic Trace Option) before proceeding to 
Step 6. 

Step 6. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu: Display the trace 

Step 7. Interpret Time Stamp Information 

The last column of the trace display gives you the absolute time stamp 
information. Note that if event A and B are called more than once, you will get 
the time between events for each occurrence. 

IMPORTANT 

You must multiply this number by the time base you selected on the Time 
Stamp Module switch in order to determine the elapsed time in seconds. 

The following screen shows the raw trace display. Since the Time Stamp Module 
switch was set to position #1 (1 uSec), the time to go from A to B is shown to 
vary from 29 uSec to 39 uSec. 
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Figure 7-5, Sample DRT Screen for Measuring Time from A to B 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 


ABS TIME 


#20 


001100> 


4E71 


R 


OVL 


SP 


0 


#35 


#19 


001100> 


4E71 


R 


OVL 


SP 


0 


#32 


#18 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#17 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#16 


001100> 


4E71 


R 


OVL 


SP 


0 


#29 


#15 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#14 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#13 


001100> 


4E71 


R 


OVL 


SP 


0 


#31 


#12 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#11 


001100> 


4E71 


R 


OVL 


SP 


0 


#38 


#10 


001100> 


4E71 


R 


OVL 


SP 


0 


#31 


#9 


001100> 


4E71 


R 


OVL 


SP 


0 


#34 


#8 


001100> 


4E71 


R 


OVL 


SP 


0 


#34 


#7 


001100> 


4E71 


R 


OVL 


SP 


0 


#36 


#6 


001100> 


4E71 


R 


OVL 


SP 


0 


#32 


#5 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 


#4 


001100> 


4E71 


R 


OVL 


SP 


0 


#31 


#3 


001100> 


4E71 


R 


OVL 


SP 


0 


#39 


#2 


001100> 


4E71 


R 


OVL 


SP 


0 


#34 


#1 


001100> 


4E71 


R 


OVL 


SP 


0 


#30 



#0 BREAK 



7-46 



ELAPSED TIME: RANGE MODE 



Range Mode 

In range mode, the trace display will show the amount of time the program is in the 
specified range. 

The manual reset button should be pressed prior to performing this measurement. 
Step 1. SetLSA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use positions 5-9, depending on your preferred time base. In these positions, the 
Event Monitor System TGR enables the counter. 

If you're not sure which time base to use, use position 9 for the slowest. If the 
counter overflows, the yellow overflow LED will light See page 7-37 for a chart 
of maximum time periods per setting. 

Step 3. Set up the Trigger Input 

To measure elapsed time, use the Event System Trigger input. No additional 
connections to the Time Stamp module are needed. 

Step 4. Set up the Event Monitor System 

AC1 = 'range Specify address comparator 1 in group 1 to be 

the specified address range 
AC 1.2 = 'range Specify address comparator 1 in group 2 to be 

the specified address range 

WHEN AC1 THEN TGR,GRO 2 

While the range is being accessed, enable the 

counter and go to group 2 
WHEN AC1.2 OR NOT AC1.2 THEN TGR 

Keep counter enabled while in group 2 
WHEN NOT AC1.2 THEN GRO 1 

Disable counter when not accessing range 

If you are tracing program flow rather than just memory access, the addresses 
need to be qualified with status. The following is an example for the 68000: 
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AC1 = 'range Specify address comparator 1 in group 1 to be 

the specified address range 
SI = SP Qualify access as supervisor program code 

AC 1.2 = 'range Specify address comparator 1 in group 2 to be 

the specified address range 
S1.2 = SP Qualify access as supervisor program code 

WHEN AC1 AND SI THEN TGR,GRO 2 

While the range is being accessed, enable the 

counter and go to group 2 
WHEN AC1.2 OR NOT AC1.2 THEN TGR 

Keep counter enabled while in group 2 
WHEN S1.2 AND NOT AC1.2 THEN GRO 1 

Disable counter when not accessing range 

Step 5. Run your Program 

ESL commands RUN Run program 

from ES Driver Target Emulation Menu Run 

Stop emulation or turn OFF TCE (Dynamic Trace Option) before proceeding to 
Step 6. 

Step 6. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu: Display the trace 

Step 7. Interpret Time Stamp Information 

The last column of the trace display gives you the amount of time accumulated 
while the program was in the specified range. 

IMPORTANT 

You must multiply this number by the time base you selected on the Time 
Stamp Module switch in order to determine the elapsed time in seconds. 

The following screen shows the raw trace display, for the above example using a 
range of $1100 to $1110. Since the Time Stamp Module switch was set to 
position #5 (0.1 uSec), the time spent in this range was 13.2 uSec. 
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Figure 7-6. Sample DRT Screen for Measuring Time in Range. 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 


ABS TIME 


#20 


001012> 


4EB8 


R 


OVL 


SP 


0 


#0 


#19 


001500 


<04D7 


W 


OVL 


SD 


0 


#0 


#18 


001014> 


1100 


R 


OVL 


SP 


0 


#0 


#17 


001100> 


4E71 


R 


OVL 


SP 


0 


#0 


#16 


001102> 


3410 


R 


OVL 


SP 


0 


#10 


#15 


0016F8 


<0000 


W 


OVL 


SP 


0 


#23 


#14 


0016FA 


<1016 


W 


OVL 


SP 


0 


#36 


#13 


001104> 


D440 


R 


OVL 


SP 


0 


#40 


#12 


001500> 


04D7 


R 


OVL 


SD 


0 


#50 


#11 


001106> 


3082 


R 


OVL 


SP 


0 


#64 


#10 


001108> 


4E75 


R 


OVL 


SP 


0 


#77 


#9 


001500 


<04DC 


W 


OVL 


SD 


0 


#90 


#8 


00110A> 


FFFF 


R 


OVL 


SP 


0 


#103 


#7 


0016F8> 


0000 


R 


OVL 


SP 


0 


#116 


#6 


0016FA> 


1016 


R 


OVL 


SP 


0 


#129 


#5 


001016> 


4E71 


R 


OVL 


SP 


0 


#132 


#4 


001018> 


60E6 


R 


OVL 


SP 


0 


#132 


#3 


00101A> 


FFFF 


R 


OVL 


SP 


0 


#132 


#2 


001000> 


4E71 


R 


OVL 


SP 


0 


#132 


#1 


001002> 


3038 


R 


OVL 


SP 


0 


#132 



#0 BREAK 
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Interrupt Latency 

To measure the amount of time between when an interrupt is detected and when it is 
serviced, you must connect your target interrupt line directly to the TGR or TGR 
lines on the Time Stamp Module. As you can see in Figure 7-7, these lines perform 
exactly the same function as the Event Monitor System TGR signal, but the direct 
trigger bypasses the delays inherent in going through the additional Event Monitor 
System logic. 

Figure 7-7. Trigger Input Logic 
ES1800 



There are two external TGR inputs: TGR and TGR. The external TGR is used with 
Motorola processors: when the line is pulled low, the interrupt is asserted. 



Time Stamp Module 



Event System 
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Figure 7-8 shows the trigger pattern for the TGR and TGR inputs. (Refer to table on 
page 7-38.) 



Figure 7-8. Trigger Pattern for TGR andTUR 



0-4 



TGR 



TGR 



5-9 



~i r 



A-E 
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Step 1. SetLSA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use positions 0-4, depending on your preferred time base. In positions 0-4, the 
TGR from the external TGR, external TGR or Event Monitor System TGR resets 
the time stamp counter to 0. 

If you're not sure which time base to use, use position 4 for the slowest. If the 
counter overflows, the yellow overflow LED will light. See page 7-9 for a chart of 
maximum time periods per setting. 

Step 3. Set up the Trigger Input 

Connect either the TGR or TGR input on the Time Stamp Module to the interrupt 
line on your target that you want to check. Since the interrupt level is encoded on 
three interrupt lines ( IPLO , IPL1 , IPL2 ) for the Motorola processors, choose 
one appropriate IPL line as a trigger. Otherwise, you must supply external logic 
to detect a particular interrupt level and generate one trigger input for the Time 
Stamp Module. To check the interrupt latency for interrupt level 1 on the 68000, 
use the setup shown in Figure 7-9. Note that this also supplies a trigger signal for 
interrupt levels 3,5, and 7. 

Figure 7-9. Target Setup for Measuring Interrupt Latency 



Target connect target interrupt to TGR input 





/ Time Stamp Module 








TGR 
TGR 


IPLO 
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Step 4. Set up the Event Monitor System 

This setup traces only those bus cycles from when the target asserts the desired 
interrupt level to when the CPU performs the interrupt acknowledge cycle. 

SI = IPw Set status comparator 1 in group 1 to the desired 

interrupt level n 

S1.2 = CPU Set status comparator 1 in group 2 to the CPU space 

function code (interrupt acknowledge cycle). 

WHEN SI THEN TRC, GRO 2 

Trace cycle and switch to group 2 on desired 
interrupt level. The Time Stamp Module has already 
received the interrupt signal through the TRG input. 

2 WHEN SI THEN GRO 1 All cycles in group 2 will be traced while 

interrupt is waiting to be serviced. The interrupt 
acknowledge cycle causes a switch back to group 1. 

Step 5. Run your Program 

ESL commands RUN Run program 

from ES Driver Target Emulation Menu Run 

Stop emulation or turn OFF TCE (Dynamic Trace Option) before proceeding to 
Step 6. 

Step 6. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu: Display the trace 

Step 7. Interpret Time Stamp Information 

The Event Monitor System traces the first cycle of the interrupt service routine. 
The last column of the the trace display shows the amount of time elapsed 
between the start of the interrupt service routine and the actual interrupt 
processing. 

IMPORTANT 

You must multiply this number by the time base you selected on the Time 
Stamp Module switch in order to determine the elapsed time in seconds. 
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NOTE 

This example shows one method of determining interrupt latency time. You 
can tailor which information is traced to your own needs by setting a 
different trigger switch on the Time Stamp Module (see the table on 
page 7-38), and/or by modifying the Event Monitor System set-up. 
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Counting Occurrences 

The number of occurrences measurement can be used to measure memory and 
program activity, module linkage activity and program flow activity. Use switch 
position F (count TGR pulses) for all counting measurements. 

Conceptually, there are two types of counting occurrences measurements: 

1. Counting the number of times the program transitions from event "A" to event 
"B" 

- used for measuring module linkage activity 

2. Counting the number of accesses to some memory location(s). 

- used for measuring memory program activity 

A to B Mode 

This mode records the number of times the transition from event "A" to event "B" 
occurs. Trace is only recorded on exit from module A. The manual reset button 
should be pressed prior to performing this measurement. 

Step 1. Set USA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use position F. For counting occurrences, the time base is irrelevant. In position 
F, when the TGR from the Event Monitor System goes high, the time stamp 
counter increments. 

Step 3. Set up the Trigger Input 

To count occurrences, use the Event System Trigger input. No additional 
connections to the Time Stamp Module are needed. 
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Step 4, Set up the Event Monitor System 



AC 1.2 = 'start-b 



AC1 = 'start-a 



AC2.2 = 'end-a 



Specify address comparator 1 in group 1 to be 
the start of module A 

Specify address comparator 1 in group 2 to be 
the start of module B 

Specify address comparator 2 in group 2 to be 
the end of module A 



WHEN AC1 THEN GRO 2 Go to group 2 while in module A 
WHEN AC1.2 THEN TGR Increment counter when entering module B 

from module A 
WHEN AC2.2 THEN TRC, GRO 1 

Exit module A, record count in trace memory 

Step 5. Run your Program 

ESL commands RUN Run program 

from ES Driver Target Emulation Menu Run 

Stop emulation or turn OFF TCE (Dynamic Trace Option) before proceeding to 
Step 6. 

Step 6. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu: Display the trace 

Step 7. Interpret Time Stamp Information 

The last column gives you the number of times module B was entered from 
module A. Note that only the location end-a is traced. In the following screen we 
see that module B is called once each time from module A. The total number of 
calls is 145. 
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Figure 7-10. Sample DRT Screen for Counting Occurrences 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 


ABS TIME 


#20 


001108> 


4E75 


R 


OVL 


SP 


0 


#126 


#19 


001108> 


4E75 


R 


OVL 


SP 


0 


#127 


#18 


001108> 


4E75 


R 


OVL 


SP 


0 


#128 


#17 


001108> 


4E75 


R 


OVL 


SP 


0 


#129 


#16 


001108> 


4E75 


R 


OVL 


SP 


0 


#130 


#15 


001108> 


4E75 


R 


OVL 


SP 


0 


#131 


#14 


001108> 


4E75 


R 


OVL 


SP 


0 


#132 


#13 


001108> 


4E75 


R 


OVL 


SP 


0 


#133 


#12 


001108> 


4E75 


R 


OVL 


SP 


0 


#134 


#11 


001108> 


4E75 


R 


OVL 


SP 


0 


#135 


#10 


0Q1108> 


4E75 


R 


OVL 


SP 


0 


#136 


#9 


001108> 


4E75 


R 


OVL 


SP 


0 


#137 


#8 


001108> 


4E75 


R 


OVL 


SP 


0 


#138 


#7 


001108> 


4E75 


R 


OVL 


SP 


0 


#139 


#6 


001108> 


4E75 


R 


OVL 


SP 


0 


#140 


#5 


001108> 


4E75 


R 


OVL 


SP 


0 


#141 


#4 


001108> 


4E75 


R 


OVL 


SP 


0 


#142 


#3 


001108> 


4E75 


R 


OVL 


SP 


0 


#143 


#2 


001108> 


4E75 


R 


OVL 


SP 


0 


#144 


#1 


001108> 


4E75 


R 


OVL 


SP 


0 


#145 



#0 BREAK 



7-57 



COUNTING OCCURRENCES: RANGE MODE 



Range Mode 

This mode records the number of accesses to some memory location(s). Trace is 
always recorded. The last trace cycles recorded show the accumulated access counts. 
The manual reset button should be pressed prior to performing this measurement. 

Step 1. Set LSA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use position F. For counting occurrences, the time base is irrelevant. In this 
position, when the TGR from the Event Monitor System goes high, the time 
stamp counter increments. 

Step 3. Set up the Trigger Input 

To count accesses, use the Event System Trigger input. 

Step 4. Set up the Event Monitor System 

AC1 = 'here TO 'there Specify the range to be monitored 

WHEN AC1 THEN TGR Increment counter whenever range is accessed 

Step 5. Run your Program 

ESL commands RUN Run program 

from ES Driver Target Emulation Menu Run 

Stop emulation or turn OFF TCE (Dynamic Trace Option) before proceeding to 
Step 6. 

Step 6. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu Display the trace 
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Step 7. Interpret Time Stamp Information 

The last column of the last line of the trace display gives you the number of times 
the range was accessed. In the following sample screen, the address range is set 
from $1400 to $1500. 



Figure 7-11. Sample DRT Screen Counting Occurrences in a Range 



>DRT 



LINE 


ADRESS 


DATA 


R/W 




FC 


IPL 


ABS TIME 


#20 


001104> 


D440 


R 


OVL 


SP 


0 


#29668 


#19 


001500> 


04D7 


R 


OVL 


SD 


0 


#29668 


#18 


001106> 


3082 


R 


OVL 


SP 


0 


#29669 


#17 


001108> 


4E75 


R 


OVL 


SP 


0 


#29669 


#16 


001500 


<04DC 


W 


OVL 


SD 


0 


#29669 


#15 


00110A> 


FFFF 


R 


OVL 


SP 


0 


#29670 


#14 


0016FO 


0000 


R 


OVL 


SD 


0 


#29670 


#13 


0016FE> 


1016 


R 


OVL 


SD 


0 


#29670 


#12 


001016> 


4E71 


R 


OVL 


SP 


0 


#29670 


#11 


001018> 


60E6 


R 


OVL 


SP 


0 


#29670 


#10 


00101A> 


FFFF 


R 


OVL 


SP 


0 


#29670 


#9 


001000> 


4E71 


R 


OVL 


SP 


0 


#29670 


#8 


001002 


3038 


R 


OVL 


SP 


0 


#29670 


#7 


001004> 


1400 


R 


OVL 


SP 


0 


#29670 


#6 


001006> 


3200 


R 


OVL 


SP 


0 


#29670 


#5 


001400> 


0005 


R 


OVL 


SD 


0 


#29670 


#4 


001008> 


0641 


R 


OVL 


SP 


0 


#29671 


#3 


00100A> 


04D2 


R 


OVL 


SP 


0 


#29671 


#2 


00100O 


307C 


R 


OVL 


SP 


0 


#29671 


#1 


00100E> 


1500 


R 


OVL 


SP 


0 


#29671 



#0 BREAK 
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Using the Time Stamp Counter Value as a Condition 

The ES 1800 Event Monitor System lets you specify complex program states, using 
WHEN-THEN statements: 

WHEN conditions THEN actions 

You can use the absolute value of the time stamp counter as one condition. 

Conditions are defined as logical combinations of address, data and status 
comparators. The comparator LSA reads the value of the time stamp counter. 

Due to the sequencing of the bit information from the Time Stamp Module, the count 
value needs to be converted to the same format used by the ES 1800, using the CTS 
(convert time stamp) command. 

Sample Situation: 

Suppose you want to break 2 seconds after reaching a specified address. If the 
pod is set to the 1 millisecond setting, this is 2000 counts. It would make sense to 
say 'LSA=#2000' as the Event Monitor System condition, but as we've explained 
above, this value must be converted. 

Step 1. Set LSA Display Type 

SET 9, 1 Set display format to absolute time stamp 

Step 2. Select Time Stamp Module Switch Setting 

Use position 4 to count every millisecond. In this position, the TGR from the 
Event Monitor System resets the counter. 

Step 3. Set up the Trigger Input 

To measure elapsed time, use the Event System Trigger input. 
No additional connections to the Time Stamp Module are needed. 

Step 4. Convert Value 

CTS #2000 Convert time stamp value for ES 1 800. The 

ES 1800 responds with $0438. This is the 
value the LSA port actually sees when the pod 
has counted 2000 times 
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Step 5. Set up the Event Monitor System 

AC1 = address to reset counter Specify the address at which to reset 

the counter 

WHEN AC1 THEN TGR,GRO 2 Reset counter and switch to group 2 

when AC1 is reached 

LSA.2=$0438 Specify the converted time stamp value 

to break at 

2 WHEN LSA THEN BRK Break when counter value is reached. 

IMPORTANT 

The ES 1800 Event Monitor System samples address, data and status once 
every processor bus cycle. If the time base is shorter than the bus cycle, then 
a particular LSA value may be missed by the Event Monitor System. 

For most processor systems, a time base of 0.01 mS, 0.1 mS or 1 mS is slow 
enough to prevent this problem. 

Step 6. Run Your Program 

ESL commands RBK Run to breakpoint 

from ES Driver Target Emulation Menu Run to breakpoint 

Wait for emulation to break when desired counter value is reached. 

Step 7. View Time Stamp Data 

ESL commands DRT Display the trace 

from ES Driver Trace Menu Display the trace 
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Step 8. Interpret Time Stamp Information 

The last column of the last line of the trace display shows the time stamp counter 
value. In the following example, the LSA register was set to break at #2000 
(CTS #2000 is converted to $0438). 

Figure 7-12. Sample DRT Screen After Breaking at Time Stamp Counter Value 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 


ABS TIME 


#20 


001016> 


4E71 


R 


OVL 


SP 


0 


#1999 


#19 


001018> 


60E6 


R 


OVL 


SP 


0 


#1999 


#18 


00101A> 


FFFF 


R 


OVL 


SP 


0 


#1999 


#17 


001000> 


4E71 


R 


OVL 


SP 


0 


#1999 


#16 


001002 


3038 


R 


OVL 


SP 


0 


#1999 


#15 


001004> 


1400 


R 


OVL 


SP 


0 


#1999 


#14 


001006> 


3200 


R 


OVL 


SP 


0 


#1999 


#13 


001400> 


0005 


R 


OVL 


SD 


0 


#1999 


#12 


001008> 


0641 


R 


OVL 


SP 


0 


#1999 


#11 


00100A> 


04D2 


R 


OVL 


SP 


0 


#1999 


#10 


00100O 


307C 


R 


OVL 


SP 


0 


#1999 


#9 


00100E> 


1500 


R 


OVL 


SP 


0 


#1999 


#8 


001010> 


3081 


R 


OVL 


SP 


0 


#1999 


#7 


001012> 


4EB8 


R 


OVL 


SP 


0 


#2000 


#6 


001500 


<04D7 


W 


OVL 


SD B 


0 


#2000 


#5 


001014> 


1100 


R 


OVL 


SP B 


0 


#2000 


#4 


001100> 


4E71 


R 


OVL 


SP B 


0 


#2000 


#3 


001102> 


3410 


R 


OVL 


SP B 


0 


#2000 


#2 


0016FC 


<0000 


W 


OVL 


SD B 


0 


#2000 


#1 


0016FE 


<1016 


W 


OVL 


SD B 


0 


#2000 



#0 BREAK 
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68020 EVENT MONITOR SYSTEM 



Overview 

This section describes the Event Monitor System (EMS) and the four trace modes 
available to you when debugging 68020 targets. It is important that you understand 
the capabilities of each trace mode before setting up the EMS. Please review the 
entire chapter, including the section on EMS shortcuts, before beginning to use the 
Event Monitor System for the 68020 microprocessor. 

The ES 1800 Event Monitor System provides extremely flexible emulator, target, and 
breakpoint control, allowing you to monitor any predefined series of conditions and 
then perform emulator actions based on those conditions. The use of the EMS is 
simple: you first set bit patterns into comparators and define conditions composed of 
logical combinations of address, data, status, count limit, and optional logic state 
probe comparators. You then define emulator actions to occur when the specified 
condition is detected during emulation. The actions include breaking emulation, 
tracing specific sequences, counting events, executing user supplied target routines, 
and triggering a TTL output. 

Since the 68020 microprocessor uses a 32 bit architecture, and the original ES 1800 
was designed for a 16 bit environment, several unique enhancements to the ES 
1800's original operating system were required to facilitate selective monitoring of 
the 68020 signals. The effect of these changes was to create four trace modes t each 
designed to trace different signal information. You can only use one trace mode at a 
time (but you can switch between trace modes whenever you wish). Before you set 
up the Event Monitor System, you must first decide which trace mode will be the best 
for your current debugging task. 

The EMS monitors target information at the bus cycle level, including every read or 
write cycle that the microprocessor executes. The EMS "sees" every signal that can 
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affect the target system, and also monitors inputs from the optional logic state 
analyzer probe. 



Figure 8-1 : The Event Monitor System 



Events 
(input) 



CPU Bus 



Actions 
(output) 




Group 
Select 

Break 

Trace 
Control 



Trigger 



Force Special 
Interrupt 

Counter 
Contol 



As the emulator executes your code, you can search for bit patterns on the CPU 
buses, count limits, or logic state analyzer (LSA) signals. When specified conditions 
(combinations of bit patterns happening simultaneously) are recognized, you direct 
the emulator to perform any of a number of actions. The combination of conditions 
and resultant actions are defined in WHEN/THEN statements. 



Bit patterns are specified with the use of comparators that compare a value you enter 
to bit patterns encountered during emulation on the signal buses. There are two 
address comparators, two data comparators, and two status comparators. 
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Once the comparators are loaded with the values you are interested in, you direct the 
emulator to take specific actions when those patterns are encountered by using 
WHEN/THEN statements. Therefore, the definition of conditions and resultant 
actions requires two steps: 

1. Load the proper comparators with the important bit patterns. You do this with 
simple assignment statements, such as: 

AC1=$7 632 (sets address comparator 1 equal to the hex value 7632) 
DC1=$ 4 OFF (sets data comparator 1 equal to the hex value 40FF) 

2. Define the combination of comparators that, when matched by patterns on the 
buses, will cause the emulator to take some action. This definition is called a 
WHEN/THEN statement, and takes the form: 

WHEN <condition> THEN <action> 

Parentheses are not allowed in WHEN/THEN statements. 

NOTE 

Normally, you create WHEN/THEN statements and set 
comparators during PAUSE mode. In some cases, you may want 
to enter WHEN/THEN statements or change comparator values 
while in run mode. If you do so, the new statements and values 
will not go into effect until you stop and restart run mode. New 
statements and comparator values will also be loaded when you 
toggle the TCE switch from OFF to ON during run mode. 

Remember that the emulator needs to know both the bit patterns to watch for (set in 
the comparators) and the combination of comparators you want to use (defined in the 
WHEN/THEN statement) before it can take the appropriate action. For instance, the 
statement: 

WHEN AC1 AND NOT DC1 THEN BRK 

tells the emulator which comparators to use (address comparator 1 and data 
comparator 1) and what action to take (break emulation), but does not specify the bit 
patterns to match in the comparators. (Note that the value in data comparator 1 is 
NOTed here, which means the comparator is matched by any bit patterns that do 
NOT match the one set in data comparator 1.) 

Conflicting WHEN/THEN statements may cause unpredictable action processing, 
although the EMS attempts to resolve conflicting commands. If you try to enter a 
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WHEN/THEN statement that cannot be true, such as: 

WHEN AC1 AND NOT AC1 THEN BRK 
the EMS will issue the error message "WARNING : NULL CLAUSE." 

NOTE 

The Event Monitor System is disabled when the Dynamic Trace feature 
is set to OFF TCE. Refer to the Dynamic Trace Capture Enable 
command in section 5 for more information. 

Also, performance analysis capabilities are built into the ES 1800 for the 
68020 processor, so the optional Time Stamp module does not work with 
the 68020 ES 1800. See the Trace Modes part of this section for more 
information on performance analysis features. 

Comparators 

Comparators are memory locations that store bit patterns. These patterns are read 
into hardware registers at the start of emulation, and the registers try to match those 
patterns to patterns found on the address bus, data bus, status lines, logic state 
analyzer lines, and in the hardware count register during emulation. When the 
patterns are encountered, the comparator is said to be "true." 

Registers are of fixed size, as shown by the table below. When you want to match a 
value greater in size than the register's storage capacity, you must split the value of 
interest into two registers and then use both registers together for the comparison. 
For example, the data registers are 16 bits in size. To match a specific 32 bit value on 
the data bus, you could store the upper 16 bits of the value in one data comparator 
and the lower 16 bits in the LSA comparator. Using both comparators ANDed 
together in a WHEN/THEN statement gives you the equivalent of a full 32 bit 
comparator. (This is actually what happens in Trace Mode 1 - see the Trace Mode 1 
section). 

Use the address comparators to detect discrete addresses or addresses inside or 
outside a specified range. You can use the data comparators to detect specific data 
patterns, including "wildcard" characters used in bit positions where you don't care 
what the bit value is. The status comparators monitor all of the status signals from 
the microprocessor as well as some signals generated by the ES 1800. The status 
comparators can also ignore bit positions if specified. The count limit comparator can 
be used to detect when an event has occurred a specified number of times. The logic 
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state analyzer comparator can detect bit patterns in the inputs from the logic state 
probe. 

Since the size and specific signals stored in each comparator depends on the trace 
mode you select, take care to set up your comparators with the current trace mode in 
mind. The Trace Modes section provides examples of setting up address and data 
comparators in different trace modes. 



The eight comparator registers are listed in the following table (sizes in parenthesis 
are apparent sizes when 32 bit comparators are enabled). 



Register 
Description 


Type 


Size 
(in bits) 


Abbreviation 


Address 1 


Range, Integer 


24 (32) 


AC1 


Address 2 


Range, Integer 


24 (32) 


AC 2 


Data 1 


Don't Care, Integer 


16 (32) 


DC1 


Data 2 


Don't Care, Integer 


16 (32) 


DC2 


Status 1 


Don' t Care, Integer 


16 


SI 


Status 2 


Don't Care, Integer 


16 


S2 


LSA 


Don't Care, Integer 


16 


LSA 


Count 


Integer 


16 


CL 



Logical Operators 

You can use more than one comparator in any WHEN/THEN statement by combining 
them with standard AND, OR, and NOT logical operators. NOT has the highest 
precedence, followed by AND and then OR. AND and OR can be used where 
needed to form more restrictive event definitions. 

With the logical operators, you can create commands such as "When the value in 
address comparator 1 is seen on the address bus, and simultaneously the value of data 
comparator 1 is seen on the data bus, break emulation." This command, in 
WHEN/THEN syntax, would take the form: 

WHEN AC1 AND DC1 THEN BRK 
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AC1 AND DC1 OR DC2 is the same as AC1 and DC1 in one statement and 
DC2 in another, since the AND conjunctive is evaluated first. If you are looking for 
two different data values at one address, use 

WHEN AC1 AND DC1 OR AC1 AND DC2 THEN 

The OR operator is evaluated left to right and is useful for simple comparator 
combinations. For complex event specifications, OR combinations can be replaced 
with separate WHEN/THEN statements for clarity. 

WHEN AC1 AND SI OR AC2 AND S2 THEN . . . 

is the same as 

WHEN AC1 AND SI THEN . . . 

and 

WHEN AC2 AND S2 THEN 



32 Bit Comparators 

With the SET 5,1 command described in Section 5, the 68020 EMS automatically 
divides the bits of a 32 bit address or data value into the appropriate registers 
necessary for a 32 bit value comparison. This gives you the illusion of using one 32 
bit register rather than two registers with the value split between them. 

If you will be entering many 32 bit values, it is usually easier to set one conceptual 
32 bit comparator rather than two partial comparators. The division of the 32 bit 
value still takes place, but it is performed by the emulator software and displayed in 
the true form of the comparator combination necessary to match the indicated 
pattern. See the appropriate Trace Mode section for further information and 
examples. 

The length of comparators displayed with the DES command change as appropriate 
when you have 32 bit comparators enabled. The address comparators, for instance, 
may be displayed as 24 bit or 32 bit registers, depending on the trace mode and 
whether 32 bit comparators are enabled. 
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Address Comparators 

You may set address comparators to integer values or range values. Following are 
examples of both: 

AC1 = 1000 
or 

AC1 = 1000 TO 1FFF 

AC2 = 1000 LEN 1000 

Both of the range examples above set the same range. Ranges may be either internal 
(TRA) or external (XRA). With external ranges, endpoints are included in the defined 
range, internal ranges do not include the endpoints. If a range is specified without 
IRA or XRA operators, the default range type will be IRA. An example of setting an 
external range follows: 



ACl = XRA $A000 TO $B000 



The 68020 CPU always attempts to fetch long word instructions, starting at a long 
word boundary (with the lowest 4 bits as 0, 4, 8, or C). Depending on whether your 
target memory is organized as long word, word, or byte, only even addresses or 
addresses that are multiples of 4 may appear on the bus when instructions are 
fetched. The emulator can only break on addresses that appear on the bus. 
Therefore, if you want to break emulation on an instruction fetch from a particular 
address, set address comparator values accordingly. 

The use of 32 bit address comparator values is simplified with the SET 5,1 command. 
See the Trace Modes section for a complete description. 

Data Comparators 

The data comparators monitor the data bus for specified patterns. Data comparators 
may be assigned integer values or don't care values. Don't care values mean that the 
value at certain bit positions may be ignored. Don't care values may be assigned in 
two ways, both using a don't care mask. The mask is a hexadecimal representation 
showing which bit positions are relevant and which are not relevant The first 
method is to specify the value followed by the don't care mask. In this case, you 
mask the irrelevant nibble positions with F's. The second way is to specify the value 
using X in the don't care positions (masking the irrelevant nibble positions with an 
X). 
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Shown below are equivilent don't care masks for a 16 bii comparator using the two 
methods. 

Method 1: DC1 = 14FF DC 00F0 
Method 2: DC1 = 14XF 

In each case, you care that bit positions 0-3 and 8-15 match the specified values, and 
don't care about values monitored by bits 4-7. 



Example 



You want to ignore only bit positions 0 and 2, all other bit positions must match the 
value set in the data comparator. Enter: 

DC1 = 272 DC %101 or 

DC1 = %1001110XlXi (in binary) 

With the SET 5,1 command, you can simplify the use of 32 bit data comparator 
values. See the Trace Modes section for a complete description. 

Status Comparators 

The status comparators monitor the CPU status for specified patterns. They are 
assigned values by combining one or more status mnemonics in the comparator. 
Including a status mnemonic when setting a status comparator means that when that 
CPU enters that status or mode the status comparator is true. The following list 
shows the available mnemonics. 
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STATUS MNEMONICS 




BER 


bus error 


IP 


interrupt pending 


AV 


autovector 


IP (0-7) 


interrupt levels 0-7 


SP 


supervisor program 


SD 


supervisor data 


UP 


user program 


CPU 


CPU space 


SC (0-7) * 


numeric names for all 8 space codes* 


TAR 


target system access 


OVL 


overlay memory access 


RD 


read access 


WR 


write access 


BYT 


byte access 


WRD 


word access 



To set a status comparator, use an assignment statement to assign the appropriate 
signal mnemonics, for example: 

51 = RD+SP (True when a read occurs from supervisor program space) 

52 = wrd+wr+up (True when a word write occurs to user program space) 

When displayed using the DES command, status comparator values are shown in 
both numeric and mnemonic forms, such as: 

SI ss $00 4F DC $FF00 (WR + OVL + IPL4) 

The display of a given bit pattern in a status comparator changes depending on your 
current trace mode, since all status signals are not traced in every mode. 

The following table provides the equivalent numeric representation for each 
mnemonic. 
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STATUS COMPARATOR BIT REPRESENTATION 

IP=00004000 DC BFFF 
AV=00002000 DC DFFF 
IP0=00000000 DC FF1F 
IP1=00000200 DC F1FF 
IP2=00000400 DC FlFF 
IP3=00000600 DC FlFF 
IP4=00000800 DC FlFF 
IP5=00000A00 DC FlFF 
IP6=OOOOOCO0 DC FlFF 
IP7=00000E00 DC FlFF 
BER=00000100 DC FEFF 
SC0=00000000 DC FF8F 
SC1/UD=00000010 DC FF8F 
SC2/UP=00000020 DC FF8F 
SC3=00000030 DC FF8F 
SC4=00000040 DC FF8F 
SC5/SD=00000050 DC FF8F 
SC6/SP=00000060 DC FF8F 
SC7/CPU=00000070 DC FF8F 
TAR=00000004 DC FFFB 
OVL=00000000 DC FFFB 
RD=00000002 DC FFFD 
WR=00000000 DC FFFD 
BYT=00000001 DC FFFE 
WRD=00000000 DC FFFE 



LSA Comparator 

The LSA comparators monitor the input pulses from the logic state probe. LSA 
signals are latched at the trailing edge of each bus cycle. LSA comparators may be 
assigned integer values or don't care values. Don't care values operate like 
wildcards, where the value at the corresponding bit position is irrelevant to the 
comparator. 

Don't care values may be assigned in two ways, both using a don't care mask. The 
mask is a hexadecimal representation showing which bit positions are relevant and 
which are not relevant. The first method is to specify the value followed by the don't 
care mask. In this case, you mask the irrelevant bit positions with F's. The second 
way is to specify the value using X in the don't care positions (masking the 
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irrelevant bit positions with an X). 

Shown below are equivilent don't care masks for a 16 bit comparator using the two 
methods. 

Method 1: LSA = 0 DC $FFF0 
Method 2: LSA = 6 DC $FFF0 

In each case, you care that bit positions 0-3 and 8-15 match the specified values, and 
don't care about values represented by bits 4-7. 



Example 



You want to ignore only bit positions 0 and 2, all other bit positions must match the 
value set in the LSA comparator. Enter: 

LSA = 272 DC %101 or 

LSA = %1001110X1X (in binary) 

Count Limit Comparator 

The count limit comparator (CL), is used to detect when events have occurred a 
certain number of times. You can set any 16 bit integer value between 1 and $FFFF. 
The count limit value is loaded into a hardware counter which is decremented 
whenever the action CNT is executed. When the count limit comparator equals zero, 
it is considered TRUE. 

The current value of the counter cannot be read. You can only detect when you have 
reached a limit. 

You can define events to count bus cycles selectively. There is one hardware counter 
and there are four count limit (CL) registers, one register for each group. The 
hardware counter is automatically loaded with the count limit register for group 1 
when entering run mode. 

To set the count limit comparator, use an assignment statement of the type: 

CL = 5 

or 

CL = <expresslon> 
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NOTE 

See the Counting section for more information on using the count limit 
comparator in WHEN/THEN statements and across groups. 
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Groups 

Groups are another important concept to grasp for effective use of the Event Monitor 
System. There are four groups (1, 2, 3, and 4) available in the EMS. With the 
exception of the count limit comparator, comparators and WHEN/THEN statements 
in one group remain independant of those in other groups. Therefore, you can switch 
from group to group to sequence events based on entirely different comparator values 
and control statements. 

The groups provide a state-machine capability for debugging difficult problems. 
WHEN/THEN statements are associated with only one of the four groups. If no 
group numbers are explicitly specified in the WHEN/THEN statement, the statement 
is automatically assigned to group 1. There are two ways to override this default 
selection of group 1: 

1. Begin the WHEN/THEN statement with a group number. For example: 

[group] WHEN <conditions> THEN <actions> 

2. Add a group number to any one of the event comparator names. For example: 

3 WHEN AC1 THEN BRK 

is functionally the same as 
WHEN AC1.3 THEN BRK. 

NOTE 

You cannot mix group numbers within a single WHEN/THEN statement. 

The four event groups provide a way to detect sequential events. When emulation is 
entered, the EMS always starts in group 1. The example below describes a common 
use of the EMS group structure. 



Example 



You may wish to trace a subroutine after it has been called by module A or module B, 
but not if it has been called from modules C, D, or E. In this case, you would define 
the address comparators in group 1 to the address ranges of modules A and B. When 
either of these modules is encountered, switch to group 2 and look for the subroutine. 
After tracing the subroutine, switch back to group 1. Shown below are the statements 
necessary to achieve this procedure (this example assumes you have the symbolic 
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debug option on - if not, use the statements in parenthesis and do not enter the starred 
statements): 



nJLUil Dyiauuxic uexjug Oil ■ 




With symbolic debug off: 


>'Module_A =1240 LEN 24 6 




(AC1 = 


1240 LEN 246) 




>'Module_B =8750 LEN 408 




(AC2 = 


8750 LEN 408) 




>'Sub_X =8934 LEN 56 




(AC1 .2 


=8934 LEN 56) 




>ACl='Module_A 




(*) 






>AC2='Module_B 




(*) 






>WHE AC1 OR AC 2 THE GRO 2 










>AC1.2='Sub_X 




(*) 






>S1.2=SP 










>2 WHEN AC1 THE TRC 










>2 WHE NOT AC1 AND Si THE 


GRO 1 








Each of the eight comparator registers for the four groups is listed in the table below 
(sizes in parenthesis depend on the trace mode, and are apparent sizes when 32 bit 
comparators are enabled with the SET 5,1 command). 


Register 


Size 




Name by Group 




Description Type 


(in bits) 


1 


2 3 


4 


Address 1 Range, Integer 


24 (32) 


AC1 or AC1.1 


AC1.2 AC1.3 


AC1.4 


Address 2 Range, Integer 


24 (32) 


AC 2 or AC2.1 


AC2.2 AC2.3 


AC2.4 


Data 1 Don't Care, Integer 


16 (32) 


DC1 or DC1.1 


DC1.2 DC1.3 


DC1.4 


Data 2 Don't Care, Integer 


16 (32) 


DC 2 or DC2.1 


DC2.2 DC2.3 


DC2.4 


Status 1 Don't Care, Integer 


16 


SI or Sl.l 


SI. 2 SI. 3 


SI. 4 


Status 2 Don't Care, Integer 


16 


S2 or S2.1 


S2.2 S2.3 


S2.4 


LSA Don't Care, Integer 


16 


LSA or LSA.l 


LSA. 2 LSA. 3 


LSA. 4 


Count Integer 


16 


CL or CL.l 


CL.2 CL.3 


CL.4 
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Emulator Actions 

Emulator actions are based on successful matching of comparators, and are set up 
with WHEN/THEN statements. You can command the emulator to perform many 
different actions with each WHEN/THEN statement. The desired emulator action(s) 
follow the THEN portion of the statement. 

The following table lists all possible actions. 



Event Monitor System Actions 



Action 


Description 


BRK 


Break emulation 


CNT 


Count Bus Cycle 


FSI 


Force Special Interrupt 


GRO 


Change Event Group 


RCT 


Load Count Value 


TGR 


Output Trigger Signal 


TOC 


Toggle Count State 


TOT 


Toggle Trace State 


TRC 


Trace Bus Cycle 



Each of the actions is described separately on the following pages. The BRK is 
described in the Breaking Emulation section. The CNT, RCT, and TOC actions are 
described in the Counting section. The FSI action is described in the Special 
Interrupt section. The GRO action is described in the Changing Event Groups 
section. The TGR action is described in the Trigger Signal section. The TRC and 
TOT actions are described in the Tracing section. 

If you want the emulator to simultaneously hunt for several different conditions, each 
requiring its own emulator action when encountered, simply define multiple 
WHEN/THEN statements. You can specify that several actions occur in each 
WHEN/THEN statement by listing the actions separated by commas: 

<group> WHEN <event> THEN <action> ,<action> , ... ,<action> 
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Example 



WHEN AC2 OR SI THEN TGR, BRK 

This example generates a trigger signal (TGR) and breaks emulation (BRK) if the 
value in address comparator 2 is recognized on the address bus or the value in status 
comparator 1 is recognized on the status lines. 

Breaking Emulation (BRK) 

The BRK action stops emulation, returning the system to pause mode. After your 
program stops, the current PC and event group is displayed. Emulation can then be 
restarted from the point of the break (if you don't alter the CPU registers or memory) 
by typing RUN or RBK. When re-entering emulation, the EMS always begins 
looking for events specified in group 1. 

After breaking, you can disassemble the trace memory, look at LSA bits in the raw 
trace, check/modify the CPU register values, or begin stepping/running through your 
code. 

Breakpoint actions may be enabled or disabled by selecting the appropriate run 
commands. If you enter emulation with the RBK or RBV run commands, breakpoint 
actions are enabled. If you enter emulation with the RUN or RNV commands, 
breakpoint actions are disabled, even if there are event statements specifying the 
BRK action. (Other WHEN/THEN statement actions are executed normally.) 

If emulation is entered with breakpoints disabled, you can enable them while running 
by entering the RBK command. If you enter emulation with breakpoints enabled, you 
can disable them while running by entering the RUN command. The RNV and RBV 
commands are not allowed during emulation. These commands load the reset 
vectors, which cannot be done during emulation. 

You can halt emulation using the STP command (see Section 6). The reset character 
also breaks emulation (default is ctrl-z, changable with the SET command), but 
does not save the CPU register information. 
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Counting (CNT), (RCT), and (TOC) 

You can set the count limit comparator (CL) to any 16-bit integer value (see the 
Count Limit Comparator section) between 1 and $FFFF, one value for each group. 
When you begin emulating, a hardware counter register global to all four groups is 
loaded with the value set in the group 1 count limit comparator. The count, CNT, 
action decrements the hardware counter register by one. When the count reaches 
zero, the CL comparator becomes true. If all other conditions in the WHEN/THEN 
clause are satisfied, the specified action is taken. 

Whenever the reset count, RCT, action is specified, the count limit comparator value 
for the current group is loaded into the hardware counter. When switching groups, 
the current value of the hardware counter is passed along to the next group as a 
global count value. However, if a RCT action is specified in the same list of events 
that causes the group switch, the count limit value for the group you are switching to 
is loaded. This feature enables you to continue counting an event that occurs across 
groups. 

The toggle count, TOC, command turns counting on and off. When on, every bus 
cycle is counted. When a TOC event is detected, the count is toggled to the opposite 
state, either on or off. You can specify an event that starts and stops the counter each 
time it is detected or specify any number of events that toggle the counter on and off 

You cannot specify both CNT and TOC as actions in one group. If you do, the latest 
command (CNT or TOC) is used and all others are disregarded. When switching 
between groups, pay special attention to the condition of the count toggle actions. 
The CNT/TOC actions interact in a specific way when event groups are switched. 
The following state transition table describes the effects of group changes on count 
actions. 
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Previous 
Group 


New Group 


Nothing 
Specified 


CNT 


TOC 


Nothing 
specified 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


CNT 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC OFF 
(not counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC ON 
(counting) 


No cycles 
counted 


Count only 
qualified cycles 


Count all cycles 
until first TOC 



This table describes initial count conditions (always group 1). 



Action Specified 


Count Condition 


Nothing 
CNT 
TOC 


No cycles counted 
Count only qualified CNT events 
Count nothing until TOC event 



Examples 



1. Count the times that the specified data are written to a specific address. Break 
if the data are written 20 times. 



>CL=#20 
>S1=WR 

>AC1=4020; DC1=$XXF3 

>WHEN AC1 AND DCl AND Si THEN CNT 

>WHEN CL THEN BRK 

>RBK 

R> 
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2. To cause a break to occur after $400 writes have occured: 



>S1 = 


WR 




>CL = 


400 




>WHEN 


SI THEN 


CNT 


>WHEN 


CL THEN 


BRK 


>RBK 






R> 







3. Look for a read from a specific I/O port. After it is found go to group 2, load the 
group 2 counter register value into the hardware counter and set a group 2 
address comparator to count every bus cycle (all addresses). Break after 100 bus 
cycles. (This example uses the symbolic debug feature.) 



>ACl=' IOport 
>S1=RD 

>WHEN AC1 AND Si THEN GRO 2, RCT 

>CL.2=#100 

>AC1.2=0 TO -1 

>2 WHEN AC1 THEN CNT 

>2 WHEN CL THEN BRK 

>RBK 

R> 



Special Interrupts (FSI) 



Registers : 

SIA Value Type - 32 Bit Integer 

Events : 

FSI 



The force special interrupt action, FSI, allows you to jump to a specified address in 
your code when a specific event is detected. You must set the special interrupt 
address register (SIA) with the address to jump to before entering run mode if you 
use the FSI action. 

The FSI event can be used as a fast way to make a patch to your code. It is also used 
to write soft shutdown routines for machinery that cannot be halted using a simple 
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breakpoint 

Your FSI routine beginning at the SIA address should terminate with a return from 
exception (RTE) instruction. Execution will resume at the address immediately 
following the instruction that caused the FSI. If this is a soft shutdown, you will 
probably define a breakpoint at the RTE instruction. 

When an FSI event is detected, an FSI ACTIVE message is displayed on the 
screen. You may also see some unusual cycles in the trace memory at the address 
where the FSI occurred. These are internal cycles that get traced as the execution 
address is changed. They are not purged from the trace memory because of the need 
for speed when executing an FSI. 



Examples 



1 . Make a patch using overlay memory. 



>MAP 1000 
>AC1=8F36 

>WHEN AC1 THEN FSI 

>SIA=1000 

>ASM SIA 



>RUN 
R> 



2. Assume the program needs to break at a certain address, but the machine cannot 
be turned off until a soft shutdown routine is executed. Set SIA to the address of 
the soft shutdown routine. Use an FSI action at the break address, then set a 
breakpoint at the end of the soft shutdown routine. (This example uses the 
symbolic debug feature.) 
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>SIA=' shut_down 

>AC1=$7F4E2 

>AC2=' shut_down + 4E 

>WHEN AC1 THEN FSI 

>WHEN AC 2 THEN BRK 

>RBK 

R> 



Trigger Signal (TGR) 

The trigger signal is a high-going TTL output available from the BNC connector 
labelled TRIG on the back panel of the ES 1800 chassis and from pin 19 of the 
optional LS A pod. When a TGR event is detected, the trigger signal is asserted, and 
remains so for the duration of the specified bus cycle. If a trigger event is specified 
for more than one consecutive bus cycle, the signal stays high for the duration of the 
consecutive bus cycles. 

The trigger signal can be used as a pulse output for triggering other diagnostic 
equipment. It can also be used in conjunction with a counter/timer for timing 
subroutines. 



Examples 



1 Trigger a scope when reading data from a UART 



>ACl='DATA_PORT 
>S1=RD 

>WHEN AC1 AND SI THEN TGR 



2. Determine the duration of a subroutine using the trigger pulse. The trigger pulse 
can be the input to a counter/timer or a scope. The duration of the subroutine 
can be determined from the pulse width displayed on the scope or the 
counter/timer readout. 
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>ACl=2500 


Start of subroutine 


>AC1.2=AC1+38E 


End of subroutine 


>DC1.2=$XXXX 


Detect any data pattern 


>WHEN AC1 THEN TGR, GRO 2 


Go to Group 2 when subroutine is entered 


>2 WHEN DC1 THEN TGR 


Trigger during all cycles while in Group 2 


>2 WHEN AC1 THEN GRO 1 


Go back to Group 1 when last instruction 


>RUN 


in subroutine is executed. 


R> 





Change Event Group (GRO) 

The GRO action lets you switch from one group to another as an action specified in a 
WHEN/THEN statement. By using different groups, you can set up WHEN/THEN 
statements for several different conditions and run them exclusively for one part of 
your code or after a specific condition is encountered. See the discussion of Groups 
for examples of using grouped WHEN/THEN statements in debugging hierarchical 
problems. 

Tracing (TRC) and (TOT) 

It is typical to record the bus activity for certain bus cycles during the debugging of a 
complex problem. This record is called trace, and can be saved in a file (in hosted 
mode) for later analysis after all pertinent information has been gathered. The Event 
Monitor System can be set up to trace bus cycles selectively. 

With the 68020 processor, you have the choice of four trace modes, each designed to 
gather different bus information. When you use the TRC and TOT commands, only 
the information gathered by the current trace mode is recorded. See the Trace Modes 
section for detailed information regarding the bus signals traced in each trace mode. 
Without WHEN/THEN statements that specify TRC or TOT, the Event Monitor 
System traces all bus cycles. If you use the TRC or TOT action in any 
WHEN/THEN statement of any group, the EMS starts emulation with trace off and 
waits for the first TRC or TOT command. Therefore, with any use of the TRC or 
TOT commands, only qualified bus cycles are traced. 

The toggle trace action (TOT) turns tracing on and off. When a TOT event is 
detected, the trace is toggled to the opposite state, either on or off. If there is a TOT 
event defined, trace will be off until the TOT is detected, then all bus cycles are 
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traced until encountering another TOT event You can specify a single event that 
starts and stops trace each time it is detected or specify any number of events that 
toggle trace on and off. 

If all of the conditions specified in the WHEN portion of the WHEN/THEN statement 
are satisfied, the trace action, TRC, records one bus cycle of activity in the trace 
memory. By using the TRC command, you can record only the bus cycles of 
interest, without intervening extraneous information. 



The following table summarizes the initial trace conditions. 



Action Specified 


Trace Condition 


Nothing 
TRC 
TOT 


Trace all cycles 
Trace only qualified TRC events 
Trace nothing until TOT event 



When switching between groups, pay special attention to the condition of the trace 
toggle actions. The TRC/TOT action interacts in a specific way when event groups 
are switched. The following state transition table describes the effects of various 
group changes on trace actions: 



Previous 
Group 


New Group 


Nothing 
Specified 


TRC 


TOT 


Nothing 
specified 


Trace all 
cycles 


Trace only 
qualified cycles 


Trace all cycles 
until first TOT 


TRC 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT OFF 
(not tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT ON 
(tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


Trace all cycles 
until first TOT 
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Trace Modes 

Trace is your window to the activity of the microprocessor. You can disassemble the 
trace buffer to see assembly instructions or you can look at raw trace to see the status 
of the CPU during each bus cycle. You may need to use both of types of trace 
information to solve a problem. 

Trace Memory 

When tracing, the Event Monitor System essentially takes a picture of the 68020 
microprocessor's signals at the end of every bus cycle (refer to Motorola's MC68020 
32 Bit Microprocessor Users Manual). The activity of the executing program is 
recorded and stored in trace memory per your command. All address lines, data 
lines, processor status lines, and external logic state analyzer lines are monitored and 
can be included in the trace memory record. This record becomes a history of the 
program. If something unexpected happens during program execution, trace memory 
can be reviewed to determine exactly what took place. 

Trace memory is 101 bits wide and 2046 bus cycles deep. Some bus cycles are used 
as marks to identify start and stop points within the trace buffer. An unqualified trace 
contains all bus activity for the last 2046 bus cycles. 

There are several commands available to display trace in different formats: the DST 
and DRT commands display trace in the raw format, and DT disassembles and 
displays the last traced instruction. DT can also be used to disassemble raw trace 
from a particular line number. You can scroll the disassembled trace buffer with the 
DTB and DTF commands. The WAI command is used to wait until execution stops 
to execute a particular command. (See Section 5 for complete descriptions of these 
commands.) 

You cannot access trace memory during emulation unless you have the Dynamic 
Trace feature. Therefore, you must stop program execution before reading the trace. 
You can stop the program either manually or by using the Event Monitor System to 
stop at the exact program state you are interested in. After program execution is 
stopped, you may review the address, data and control signals of the most recently 
traced cycles. 
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Dynamic Trace (Optional) 

The Dynamic Trace feature of the ES 1800 allows you to read trace while the target 
is running. With this feature, you can examine trace in target systems while the 
system is emulating. With targets using multiple multiprocessors, dynamic trace lets 
you examine trace from one processor without shutting down all processors. 

The Event Monitor System is disabled when the Dynamic Trace feature is turned off 
with the OFF TCE command. Refer to the Dynamic Trace Capture Enable 
command in section 5 for more information. 

Selecting a Trace Mode 

The ES 1800 Event Monitor System is based on a 16 bit environment. The 68020 
microprocessor consists of a 32 bit architecture. To incorporate the 68020 into the 
ES 1800 chassis, some enhancements were introduced to the emulator's operating 
system to facilitate selective tracing. 

These enhancements consist of four trace modes, which allow you to select the 
signals you'd like to record in trace memory during emulation. The ES 1800 Event 
Monitor System is designed to use trace information to cause event actions. Before 
you can start emulation, you must select one of the trace modes (or use the default - 
Trace Mode 2). 

When assigning values to the address comparators in any mode, single values and 
ranges are acceptable. The data comparators and the LSA comparators (DO, DC2 
and LSA) may have masked (don't care) values. The status comparators are set with 
mnemonic signal names. The count limit register can be between 1 and $FFFF. 
Please refer to the Comparators section for a complete description of each 
comparator. 

The ES 1800's trace buffer remains constant in width at 101 bits. However, the 
composition of those 101 bits differs with each trace mode. Different information is 
stored in trace memory and displayed in raw trace depending on the trace mode. The 
following table summarizes the information traced in each mode. 
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TRACE MODE 


ADDR 


DATA 


STATUS 


TIMER 


LSA 


0 


24 


16 


19 


24 


16 


1 


24 


32 


19 


24 


0 


2 


32 


32 


11 


24 


0 


3 


32 


16 


21 


24 


6 



Regardless of which trace mode is selected, the following information is always 
traced and displayed in raw trace (with the DRT command). 



AO - A23 
D16 - D31 
R/W - 
TGT/OVL 
FC0 - FC2 



A detailed description of the signals monitored in each trace mode and their location 
in the event comparators is shown in the chart on page 8-29. 

You can select a trace mode by using the SET command in the form: 



> SET 4,# (where # is the number of the desired trace mode) 



If you also want to enable the 32 bit comparators, enter: 



> SET 5,1 



(See the Comparators section for more information.) 

CAUTION 

We recommend that you issue a CES command immediately after changing trace 
modes with 32 bit comparators enabled. Changing between trace modes with 32 bit 
comparators enabled changes the meaning of your original WHEN/THEN 
statements, and can cause completely different and unexpected emulator actions. The 
error message: 

WARNING - EVENT SYSTEM SETUP IS INCOMPATIBLE ACROSS TRACE/BREAKPOINT MODES 

is issued if you try this. 
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To view the selected mode of operation, type in: 



> SET (refer to line 4) 



The following paragraphs briefly summarize the signals and bits traced in each of the 
trace modes. For more detail, see the individual trace mode sections. 

Trace mode 0... page 8-31 

When using trace mode 0, the EMS operates basically the same as the 68010 EMS. 
The AVEC signal replaces VPA~ and IPEND~ replaces VMA~ . The breakpoint 
assembler recognizes AV for AVEC and IP for IPEND. Five additional signals are 
traced: OCS, DSACK1, DSACKO, SIZ1, and SIZO. 

16 LSA lines are available in trace mode 0. Since only 24 address and 16 data bits 
are traced in trace mode 0, the upper 8 address bits and the lower 16 data bits are 
ignored. Also, RMC and CDIS" are not traced. 

Trace mode 1... page 8-37 

Select trace mode 1 if you need to trace all 32 bits of data. As in trace mode 0, the 
upper 8 address bits are ignored. All the signals traced in trace mode 0 are also traced 
in mode 1 except the 16 LSA bits, which are replaced by data bits 0-15. 

Trace Mode 2... page 8-44 

Select trace mode 2 if you need to trace all 32 address and data bits. Also, this is the 
only mode with which you can use the trace disassembler. The LSA bits are replaced 
with data bits 0-15, and certain status bits are replaced with A24-A31. IPL0-2~ , 
IPEND" , BERR" , RMC , CDIS" , and AVEC" are not traced in this mode. This is 
the default trace mode. 

Trace Mode 3... page 8-52 

Select trace mode 3 to trace 32 address, 16 data, and all status lines. There are 6 LSA 
lines available for use in this mode (except with the 25 MHz 68020). 
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Figure 8-2. Address data, timer, status lines and LSA bits for each trace mode 
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0 
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D10 
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Trace Mode 0 

When using trace mode 0, the 40 conductor cable from the pod is not used. You may 
remove it and connect the optional Logic State Probe instead. 

Figure 8-3. Trace Mode 0 Connections 




When using trace mode 0, the EMS operates basically the same as the 68000/08/10 
Event Monitor System. The AVEC signal replaces VPA" and IPEND - replaces 
VMA" . The breakpoint assembler recognizes AV for AVEC and IP for IPEND. Five 
additional signals are traced: OCS, DSACK1, DSACK0, SIZ1, and SIZ0. In this 
mode, these signals can be viewed only by using the DST command. They are 
displayed in place of the IPL and LS A columns. 



Since no 32 bit comparators are used in this trace mode, the SET 5,1 command has 
no effect on the comparators, and only changes the EMS display (shown after a DES 
command). 

Be aware, however, that only 24 address and 16 data bits are traced, which means 
that the upper 8 address bits and the lower 16 data bits are ignored. Also, RMC" and 
CDIS" are not traced in mode 0. 
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NOTE 

With the 25 MHz 68020 emulator, this is the only mode that supports the 
LS A probe. 

In trace mode 0, the trace buffer contains 24 address bits, 16 data bits, 20 status bits, 
16 logic state bits, and 24 timer bits. For mode 0, these bits trace the following: 

Address bits: 



AO 


through A23 


on the 


trace 


card will trace 


AO 


through A23 


of the 


68020 


address bus . 



Data bits: 



DO through D15 on the trace card will trace 
D16 through D31 of the 68020 data bus. 
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Status bits: 



SO through S14 on the trace card will trace: 


Interrupt Pending 


(S14) 


Autovector 


(S13) 


Break 


(S12) 


Interrupt Line 2 


(Sll) 


Interrupt Line 1 


(S10) 


Interrupt Line 0 


(S9) 


Bus Error 


(S8) 


Memory Access Violation 


(S7) 


Memory Write Violation 


(S7) 


Function code line 2 


(S6) 


Function code line 1 


(S5) 


Function code line 0 


(S4) 


(not used) 


(S3) 


TGT/OVL 


(S2) 


Read/Write 


(SI) 


Byte /Word 


(SO) 


Additional bits displayed in 


raw trace: 




OCS 




DSACK0 




DSACK1 




SIZ0 




SIZ1 




Logic state bits: 


LS0 through LS15 on the 


trace card will trace 


LS0 through LS15 of the 


optional logic state pod. 
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The status comparators (SI and S2) may be set up with a variety of different 
conditions to further qualify the desired emulator action. The acceptable status 
mnemonics are: 



BYT or WRD 
RD or WR 
TAR or OVL 

Any one of the function codes: SCO 

SC1/UD 
SC2/UP 
SC3 
SC4 

SC5/SD 
SC6/SP 
SC7/CPU 

BER 

Any one of the interrupt priorities, IPO through IP7 

AV (autovector) 

IP (interrupt pending) 



When setting up a status comparator, the following examples are acceptable: 



S1=BYT 

Sl=RD+OVL 

S2=BER+TAR 

S2=SC4+RD+BYT 

S1=IP4 



As you can see, multiple choices for the status comparators are allowed, however, 
conflicting (mutually exclusive) mnemonics are not allowed in the same status 
comparator. For example, you should not set the status comparator to BYT+WRD, 
RD+WR, or SD+SC4 because these status signals would not happen simultaneously. 
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You can select one mnemonic from each column in the following table to build a 
status comparator: 



STATUS 


MNEMONIC TABLE 




SI = BYT + RD + TAR + 


SCO + BER + 


IPO + AV + IP 


WRD WR OVL 


SC1/UD 


IP1 




SC2/UP 


IP2 




SC3 


IP3 




SC4 


IP4 




SC5/SD 


IP5 




SC6/SP 


IP6 




SC7/CPU 


IP7 


(Only one out of each category) 





The following table shows how the status bits are used in the status comparator: 









STATUS 


COMPARATOR BREAKDOWN 




14 13 


12 


11 


10 


9 8 7 


6 5 4 


3 2 10 


1 1 


1 


\ 


1 


/ 1 


\ 1 / 


1 1 1 


1=IP 1=AV 






0=IP0 


1=BER 


0=SC0 


0=OVL | | 








1=IP1 




1=SC1/UD 


1=TAR | | 








2=IP2 




2=SC2/UP 


0=WR | 








3=IP3 




3=SC3 


1=RD | 








4 = IP4 




4=SC4 


0=WRD 








5=IP5 




5=SC5/SD 


1=BYT 








6-TP6 




6=SC£/SP 










7=IP7 




7=SC7/CPU 
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An example of a mode 0 trace display follows: 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 




LSA - 8 


7-0 


TIME 




#20 


F0053C 


> 


51CB 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


418 


MS 


#19 


F0053E 


> 


FFF8 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


418 


MS 


#18 


F00540 


> 


6024 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


419 


MS 


#17 


F00542 


> 


4 AO 3 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


420 


MS 


#16 


F00534 


> 


007E 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


421 


MS 


#15 


F00536 


> 


301A 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


421 


MS 


#14 


F00538 


> 


E309 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


422 


MS 


#13 


F0053A 


> 


6506 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


423 


MS 


#12 


F005BA 


> 


0000 


R 


TAR 


SD 


0 




%11111111 


%11111111 


307 


424 


MS 


f 11 


F0053C 


> 


51CB 


R 


TAR 


SP 


0 




ai 1111111 

Ttllllllll 


Q-1 1111111 
Tjllllllll 


307 


424 


MS 


#10 


F0053E 


> 


FFF8 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


425 


MS 


#9 


F00540 


> 


6024 


R 


TAR 


SP 


0 




%11111111 


%11111111 


307 


426 


MS 


#8 


F00542 


> 


4 AO 3 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


427 


MS 


#7 


F00534 


> 


007E 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


427 


MS 


#6 


F00536 


> 


301A 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


428 


MS 


#5 


F00538 


> 


E309 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


429 


MS 


#4 


F0053A 


> 


6506 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


429 


MS 


#3 


F005BC 


> 


0000 


R 


TAR 


SD 


0 


IP 


%11111111 


%11111111 


307 


430 


MS 


#2 


F0053C 


> 


51CB 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


431 


MS 


#1 


F0053E 


> 


FFF8 


R 


TAR 


SP 


0 


IP 


%11111111 


%11111111 


307 


431 


MS 



#0 BREAK 
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Trace Mode 1 

Trace mode 1 requires that the 40 conductor cable from the pod be connected to the 
Logic State Probe connector on the front panel of the ES. 

Figure 8-4. Trace Mode 1 Connections 




Select trace mode 1 to trace all 32 bits of data. All the signals traced in mode 0 are 
also traced in mode 1 except the 16 LSA bits, which are replaced by data bits 0-15 to 
complete the 32 bit data trace. As in trace mode 0, the upper 8 address bits are 
ignored. The LSA field is not shown in the raw trace display. 

You can either manually set the data comparator and the LSA comparator for 32 bit 
data values, or use the SET 5,1 command to have the EMS automatically treat data 
values as 32 bit values. In either case, the Event Monitor System uses the LSA 
comparator in this mode to detect the lower word of a 32 bit data event. 



For mode 1, the trace bits trace the following: Address bits: 



AO 


through A23 


on the 


trace 


card will trace 


AO 


through A23 


of the 


68020 


address bus. 
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Data bits: 



DO through D15 on the trace 


card will trace 


D16 through D31 of the 68020 


data bus. 


Status bits: 


SO through S14 on the trace card 


will trace: 


Interrupt Pending 


(S14) 


Autovector 


(S13) 


Break 


(S12) 


Interrupt Line 2 


(Sll) 


Interrupt Line 1 


(S10) 


Interrupt Line 0 


(S9) 


Bus Error 


(S8) 


Memory Access Violation 


(S7) 


Memory Write Violation 


(S7) 


Function code line 2 


tbb) 


Function code line 1 


(S5) 


Function code line 0 


(S4) 


(not used) 


(S3) 


TGT/OVL 


(S2) 


Read/Write 


(SI) 


Byte/Word 


(SO) 


Additional bits displayed in raw 


trace : 


OCS 




DSACKO 




DSACK1 




SIZO 




SIZ1 
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Logic state bits: 



LS0 through LS15 on the trace card will trace 
DO through D15 of the 68020 data bus. 



When viewing the raw trace, all information is displayed under logical columns for 
easy viewing. For example, even though the logic state bits are tracing the lower 
data bits, the lower data bits will show in the data field of the trace. 



Examples 



To set up a comparator using the data bus, please remember to use the data 
comparators (DO and DC2) and the logic state comparator (LSA). 

1. With 32 bit comparators disabled, you would have to enter the following set of 
statements to break on the value $12345678 in trace mode 1 or 2: 



>DC1=$1234 
>LSA=$5678 

>WHEN DC1 AND LSA THEN BRK 



With 32 bit comparators enabled, the same command becomes: 



>DC1=$12345678 
>WHEN DC1 THEN BRK 



The emulator interprets this and immediately displays: 



>WHEN DC1 AND LSA THEN BRK 
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Notice the LSA comparator is used for the lower data bits (D0-D15) and DC1 is 
used for the upper data bits (D16-D32). In the example above, DC1 is set to 
$1234, and the LSA comparator is automatically set to $5678. The LSA 
comparator is used for the lower word of both data comparators, so in the 
example above the lower word of DC2 would also be set to $5678. 

Since the LSA comparator is used for data in this mode, you cannot refer to the 
LSA comparator in WHEN/THEN statements or store values to the LSA 
comparator with 32 bit comparators enabled. These actions will result in an error 
message. 

The status comparators (SI and S2) may be set up with a variety of different 
conditions to further qualify your particular event action. The acceptable status 
mnemonics are as follows: 



BYT or WRD 
RD or WR 
TAR or OVL 

Any one of the function codes SCO 

SC1/UD 
SC2/UP 
SC3 
SC4 

SC5/SD 
SC6/SP 
SC7/CPU 

BER 

Any one of the interrupt priorities, IPO through IP 7 

AV (autovector) 

IP (interrupt pending) 
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When setting up a status comparator, the following examples are acceptable: 



S1=BYT 

Sl=RD+OVL 

S2=BER+TAR 

S2=SC4+RD+BYT 

S1=IP4 



As you can see, multiple choices for the status comparators are allowed, however, 
only one from each category should be used. For example, you should not set the 
status comparator to BYT+WRD, RD+WR, or SD+SC4 because these combinations 
of status signals would not happen simultaneously. 



Therefore, SI and S2 can equal the following: 







STATUS 


MNEMONIC 


TABLE 




SI = BYT 


+ RD 


+ TAR + 


SCO + 


BER + 


IPO + AV + IP 


WRD 


WR 


OVL 


SC1/UD 




IP1 








SC2/UP 




IP2 








SC3 




IP3 








SC4 




IP4 








SC5/SD 




IP5 








SC6/SP 




IP6 








SC7/CPU 




IP7 


(Only one 


out of 


each category) 







The following table shows how the status bits are used in the status comparator: 
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STATUS 


COMPARATOR 


BREAKDOWN 




14 13 


12 


11 


10 


9 8 7 


6 5 4 3 


2 10 


1 1 


1 


\ 


1 


/ 1 


\ 1 / 


1 1 1 


1=IP 1=AV 






0=IP0 


1=BER 


o=sco 


0=O VL | | 








1=IP1 




1=SC1/UD 


1=TAR | | 








2=IP2 




2=SC2/UP 


0=WR | 








3=IP3 




3=SC3 


1=RD | 








4 = IP4 




4=SC4 


0=WRD 








5 = IP5 




5=SC5/SD 


1=BYT 








6=IP6 




6=SC6/SP 










7=IP7 




7=SC7/CPU 
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An example of a mode 1 trace display follows: 



>DRT 



LINE 


ADDRESS 


DATA 


R/W 




FC 


IPL 




DS 


SZ 


OCS 


TIME 




#20 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


S 


#19 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


396 


S 


#18 


F00540 


> 


6024FFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


S 


#17 


F00542 


> 


4A03FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


396 


S 


#16 


F00534 


> 


007EFFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


S 


#15 


F00536 


> 


301AFFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


396 


s 


#14 


F00538 


> 


E30 9FFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


s 


#13 


F0053A 


> 


650 6FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


396 


s 


#12 


F005B4 


> 


004AFFFF 


R 


TAR 


SD 


0 




01 


10 


0 


1 


396 


s 


#11 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


s 


#10 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


396 


s 


#9 


F00540 


> 


6024FFFF 


R 


TAR 


SP 


0 




01 


00 


0 


1 


396 


s 


#8 


F00542 


> 


4A03FFFF 


R 


TAR 


SP 


0 




01 


10 


1 


1 


.396 


s 


#7 


F00534 


> 


007EFFFF 


R 


TAR 


SP 


0 


IP 


01 


00 


0 


1 


.396 


s 


#6 


F00536 


> 


301AFFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 


#5 


F00538 


> 


E309FFFF 


R 


TAR 


SP 


0 


IP 


01 


00 


0 


1 


.396 


s 


#4 


F0053A 


> 


650 6FFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 


#3 


F005B6 


> 


005 6FFFF 


R 


TAR 


SD 


0 


IP 


01 


10 


0 


1 


.396 


s 


#2 


F0053C 


> 


51CBFFFF 


R 


TAR 


SP 


0 


IP 


01 


00 


0 


1 


.396 


s 


#1 


F0053E 


> 


FFF8FFFF 


R 


TAR 


SP 


0 


IP 


01 


10 


1 


1 


.396 


s 



#0 BREAK 
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Trace Mode 2 

Using trace mode 2 requires that the 40 conductor cable from the pod be connected 
to the Logic State Probe connector on the front panel of the ES 1800. 

Figure 8-5. Trace Mode 2 Connections 




Select trace mode 2 to trace all 32 address and data bits. Data bits 0-15 are traced in 
the LSA register, and address bits A24-A31 replace certain status bits. Status signals 
IPLO-2" , IPEND" , BERR" , and AVEC" are not traced in this mode. 

In mode 2, the trace bits trace the following: 

Address bits: 



AO through A23 on the trace card will trace 
AO through A23 of the 68020 address bus. 
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Data bits: 



DO through D15 on the trace card will trace 
D16 through D31 of the 68020 data bus. 



Status bits: 



SO through S14 on the trace card will trace: 



68020 Address Bit 31 (S14) 

68020 Address Bit 30 (S13) 

68020 Address Bit 29 (S12) 

68020 Address Bit 28 (Sll) 

68020 Address Bit 27 (S10) 

68020 Address Bit 26 (S9) 

68020 Address Bit 25 (S8) 

68020 Address Bit 24 (S7) 

Function code line 2 (S6) 

Function code line 1 (S5) 

Function code line 0 (S4) 

(not used) (S3) 

TGT/OVL (S2) 

Read/Write (SI) 

Byte/Word (SO) 



Logic state bits: 



LS-Q through LSI 5 on the traee eard will trace 
DO through D15 of the 68020 data bus. 



When viewing the trace history, all information will be in logical areas for easy 
viewing. For example, even though the logic state bits are tracing the lower data bits, 
the lower data bits will show in the data field of the trace. 
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Examples 



1. To set the Event Monitor System to break on a 32 bit address, remember that 
you will need to use a status comparator (SI or S2) and an address comparator 
(AC1 or AC2). You can divide the value between the comparators manually, or 
enable 32 bit comparators with the SET 5,1 command. For example, to break 
on the address value $FFFF3040, use the following procedure. 

With 32 bit comparators disabled: 



>AC1=$FF3040 

>S1=$7F80 DC $807F 

>WHEN AC1 AND Si THEN BRK 

>RBK 



NOTE 

The AC1 comparator is looking for the lower 24 bits (A0-A23) and the 
SI comparator (S7-S14) is looking for the upper 8 address bits (A24- 
A31) of a 32 bit address. The LSA comparator is used for the lower data 
bits (D0-D15) and DC1 is used for the upper data bits (D16-D32) of a 32 
bit data value. Because of this, you cannot refer to the status or LSA 
comparators in WHEN/THEN statements or store values to those 
comparators with 32 bit comparators enabled. These actions will result 
in an error message. 

The "DC $807F" is a mask that will cause the Event Monitor System to ignore the 
other information being traced on those particular status lines when determining if a 
comparator has been reached. However, the trace will still display that information. 

You can always use binary to set comparators, although the need for such entries is 
rare. An example follows (entering a status value). Notice the % character 
preceeding the value, which specifies a binary entry. 



>S1=%0111111110000000 DC %1000000001111111 



SI will be displayed in hexadecimal unless the global default (DFB) or the SI default 
base has been altered. (Please refer to page 5-85.) With 32 bit comparators enabled: 
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>ACl=$FFFF3040 
>WHEN AC1 THEN BRK 
>RBK 



After the 32 bit value is assigned to address comparator 1, the upper eight address 
bits are automatically entered into status comparator 1. SI will immediately be 
displayed, as follows, so that you can see if any unwanted status information is also 
set there. 



>WHEN AC1 AND Si THEN BRK 



2. Another example of breaking on a 32 bit address using address $12345678 
follows: 



>AC1=$345678 

>S1 =$900 DC $807F 

>WHEN AC1 AND SI THEN BRK 

>RBK 



To set up a comparator using the data bus, remember to use a data comparator (DO 
or DC2) and the logic state comparator (LSA). For example, when setting up a break 
on the data pattern $12345678, use the following procedure. 

1. With 32 bit comparators disabled, you would have to enter the following set of 
statements to break on the value $12345678 in trace mode 2: 



>DC1=$1234 
>LSA=-$-5678 

>WHEN DC1 AND LSA THEN BRK 



With 32 bit comparators enabled, the same command becomes: 



>DC1=$12345678 
>WHEN DC1 THEN BRK 
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The emulator interprets this and immediately displays: 



>WHEN DC1 AND LSA THEN BRK 



Notice the LSA comparator is used for the lower data bits (D0-D15) 
and DC1 is used for the upper data bits (D16-D32). In the example 
above, DC1 is set to $1234, and the LSA comparator is automatically 
set to $5678. The LSA 

comparator is used for the lower word of both data 

comparators, so in the example above the lower word of DC2 would 

also be set to $5678. 



The status comparator may be set up with a variety of different conditions to further 
qualify your particular event action. The acceptable status mnemonics are: 



BYT 


or WRD 




RD 


or WR 




TAR 


or OVL 




Any 


one of the function codes: 


SCO 






SC1/UD 






SC2/UP 






SC3 






SC4 






SC5/SD 






SC6/SP 






SC7/CPU 



When setting up a status comparator, the following examples are acceptable: 



S1=BYT 

Sl=RD+OVL 

S2=SC4+RD+BYT 



As you can see, multiple choices for the status comparators are allowed, however, 
only one from each category should be used. For example, you should not set the 
status comparator to BYT+WRD, RD+WR, or SD+SC4 because this combination of 
status signals would not happen simultaneously. 
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Therefore, SI and S2 can equal the following: 







STATUS 


MNEMONIC 


TABLE 






SI 


BYT 


+ 


RD + 


TAR 


+ 


SCO 




WRD 




WR 


OVL 




SC1/UD 














SC2/UP 














SC3 














SC4 














SC5/SD 














SC6/SP 














SC7/CPU 


{Only 


one out 


of each 


category) 









NOTE 

When 32 bit comparators are enabled, be sure to assign the desired value 
to the status comparators before entering the address comparator 
value(s). Since the upper bits of the status register are used for bits 24-31 
of the address comparator, storing any value to the status comparator 
will clear the address bits set there. 

If you want to preserve the address bits set in a status comparator while 
adding a new status signal (WR, for instance), you can always use the 
construction: 

SI = Sl+WR 

In 32 bit comparator mode, also be careful when using the logical operators to 
combine comparators. For instance, the statement: 

WHEN NOT AC1 THEN . . . 

will result in an error message, since the status comparators contain both status and 
address information in this trace mode. 

The statement: 

WHEN AC1 AND NOT SI THEN . . . 

will also not be accepted, since it would require the EMS to set up a conflicting 
statement. The general rule of thumb is "If you are not sure about whether a certain 
WHEN/THEN construction is nonambiguous, try it" If you receive an error message 
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of the form 

[comparator combination] : CAN'T PROCESS IN THIS MODE 

then you'll have to try to more precisely state your goal, possibly requiring more than 
one WHEN/THEN statement. For more complicated events, you may want to disable 
32 bit comparators and enter your WHEN/THEN statement in regular mode. 



The following table shows how the status bits are used in the status comparator: 


STATUS COMPARATOR BREAKDOWN 






14 13 12 11 10 9 8 7 6 5 4 


3 2 1 


0 


1 1 1 1 1 1 1 1 \ 1 / 


1 1 




A31 A30 A29 A28 A27 A26 A25 A24 0=SC0 


0=OVL | 




1=SC1/UD 


1=TAR | 




2=SC2/UP 


0=WR 




3=SC3 


1=RD 




4=SC4 


0= 


=WRD 


5=SC5/SD 


1= 


=BYT 


6=SC6/SP 






7=SC7/CPU 
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An example of a mode 2 trace display follows: 



>DRT 



LINE 


ADDRESS 




DATA 


R/W 




FC 


DS 


sz 


ocs 


TIME 




#20 


FFF00506 


> 


00C0FFFF 


R 


TAR 


SP 


01 


10 


1 


1. 


215 


s 


#19 


FFF00508 


> 


206DFFFF 


R 


TAR 


SP 


01 


00 


o 


1. 


215 


s 


#18 


FFF0050A 


> 


0 4 1 AFFFF 


R 


TAR 


SP 


01 


10 


1 


1. 


215 


s 


#17 


FFF21C72 


< 


FFFBFFFB 


w 


TAR 


SD 


01 


00 


o 


1. 


215 


s 


#16 


FFF21C74 


< 


00400040 


w 


TAR 


SD 


01 


10 


1 


1. 


215 


s 


#15 


FFF21C6E 


< 


FFF2FFF2 


w 


TAR 


SD 


01 


00 


0 


1. 


215 


s 


#14 


FFF21C70 


< 


04220422 


w 


TAR 


SD 


01 


10 


1 


1. 


215 


s 


#13 


FFF0050C 


> 


22 68FFFF 


R 


TAR 


SP 


01 


00 


o 


1 


215 


s 


#12 


FFF0050E 


> 


000CFFFF 


R 


TAR 


SP 


01 


10 


1 


1. 


215 


s 


#11 


FFF204 1A 


> 


FFF2FFFF 


R 


TAR 


SD 


01 


00 


o 


1 


215 


s 


fflu 


fit iUI 1L 


> 




R 


TAR 


bU 




i n 


± 


1 


215 


c 
b 


#9 


FFF00510 


> 


4A29FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


215 


s 


#8 


FFF00512 


> 


0007FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


215 


s 


#7 


FFF2042E 


> 


FFFBFFFF 


R 


TAR 


SD 


01 


00 


0 


1 


215 


s 


#6 


FFF20430 


> 


0040FFFF 


R 


TAR 


SD 


01 


10 


1 


1 


215 


s 


#5 


FFF00514 


> 


6A02FFFF 


R 


TAR 


SP 


01 


00 


0 


1 


215 


s 


#4 


FFF00516 


> 


6106FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


215 


s 


#3 


FFFB0047 


> 


44FFFFFF 


R 


TAR 


SD 


10 


01 


0 


1 


.215 


s 


#2 


FFF00518 


> 


4CDFFFFF 


R 


TAR 


SP 


01 


00 


0 


1 


.215 


s 


#1 


FFF0051A 


> 


0300FFFF 


R 


TAR 


SP 


01 


10 


1 


1 


.215 


s 



#0 BREAK 
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Trace Mode 3 

Trace mode 3 requires that the 40 conductor cable from the Pod be connected to the 
Logic State Probe connector on the front panel of the ES. The optional LSA pod can 
be plugged into the logic state probe connector on the 68020 pod (except on the 25 
MHz version). With the 25 MHz 68020 emulator, you cannot use the LSA pod in 
trace mode 3. 

Figure 8-6a. Trace Mode 3, 25 MHz 68020 Connections 
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Figure 8-6b, Trace Mode 3 } 16 MHz 68020 Connections 




Mode 3 would be selected to trace 32 address, 16 data, and all status lines. There are 
6 LS A lines available for use in this mode (except with the 25 MHz 68020). 

In this mode, the high address byte (A24-A31) is set up in the high 8 bits of the LSA 
register and the status comparators are assigned as in modes 1 and 2 (refer to page 8- 
29). Two additional status signals, RMC" and CDIS" , are traced in this mode using 
the LSA comparator. 

You can either manually set the address comparator and the LSA comparator, or use 
the SET 5,1 command to have the EMS automatically treat address values as 32 bit 
values. In either case, the Event Monitor System uses the LS A comparator in this 
mode to detect a 32 bit address event 

For mode 3, the trace bits trace the following: 
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Address bits: 



AO through A23 on the trace 


card 


will trace 


AO through A23 of the 68020 


address bus. 


Data bits: 


DO through D15 on the trace 


card 


will trace 


D16 through D31 of the 68020 


data bus. 


Status bits: 


SO through S14 on the trace 


card 


will trace: 


Interrupt Pending 




(S14) 


Autovector 




(S13) 


Break 




(S12) 


Interrupt Line 2 




(Sll) 


Interrupt Line 1 




(S10) 


Interrupt Line 0 




(S9) 


Bus Error 




(S8) 


Memory Access Violation 




(S7) 


Memory Write Violation 




(S7) 


Function code line 2 




(S6) 


Function code line 1 




(S5) 


Function code line 0 




(S4) 


(not used) 




(S3) 


TGT/OVL 




(S2) 


Read/Write 




(SI) 


Byte/Word 




(SO) 
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Logic state bits: 



LS0 through LS15 on the 


trace card will trace 


the following 








68020 Address 


Bit 


31 on 


LS15 


68020 Address 


Bit 


30 on 


LS14 


68020 Address 


Bit 


2 9 on 


LS13 


68020 Address 


Bit 


28 on 


LS12 


68020 Address 


Bit 


27 on 


LS11 


68020 Address 


Bit 


2 6 on 


LS10 


68020 Address 


Bit 


25 on 


LS9 


68020 Address 


Bit 


24 on 


LS8 


Read Modify Write 


Cycle 


(RMC) on LS7 


Cache Disable 


(CDIS) on 


LS6 



The remaining lines (LS0-LS5) come from the Logic State Analyzer pod option. To 
use these lines, plug the pod into the connector located on the 16 MHz 68020 pod 
face plate. Use only the first 6 lines. 

When viewing the trace, all information will be in logical areas for easy viewing. 
For example, even though the upper logic state bits are tracing the upper address bits, 
these bits will be displayed in the address field of the trace. 

To set up a comparator using the address bus, remember to use an address comparator 
(AC1 or AC2) and the logic state comparator (LSA). For example, when setting a 
breakpoint on the address $12345678, use the following procedure: 



>AC1=$345678 

>LSA=$12 DC $00FF 

>WHEN AC1 AND LSA THEN BRK 

>RBK 



Notice the LSA comparator is used for the upper address bits (A24-A31) and AC1 is 
used for the lower address bits (A0-A23). Because of this, you cannot refer to the 
LSA comparator in WHEN/THEN statements or store values to the LSA comparator 
with 32 bit comparators enabled. These actions will result in an error message. 

Event Monitor System to ignore the information that is being traced in the remaining 
LSA bits. 
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The following chart may aid in setting up the LS A comparator: 



LS15 


LS14 


LS13 


LS12 


LS11 


LS10 


LS9 


LS8 


LS7 


LS6 


LS5 


LS4 


LS3 


LS2 


LSI 


LSO 


1 

A31 


1 

A30 


1 

A29 


1 

A28 


1 

A27 


1 

A26 


1 

A25 


1 

A24 


1 

RMC 


1 

CDC 


1 

LS5 


1 

LS4 


1 

LS3 


1 

LS2 


1 

LSI 


1 

LSO 



To setup the Event Monitor System to break on cache disable, refer to the following 
example: 



>LSA = 40 DC $FFBF 
>WHEN LSA THEN BRK 
>RBK 



With 32 bit comparators enabled (SET 5,1), the LSA comparator will automatically 
be loaded with the appropriate address infgormation whenever a value is entered into 
AC1 or AC2. Note that the upper eight bits of AC1 and AC2 will always be the 
same, since the same LSA comparator is used for both. If the statement: 



WHEN AC1 THEN BRK 



is entered, the EMS will automatically change this statement to: 



WHEN AC1 AND LSAl THEN BRK 



Whenever you use the address comparators with 32 bit comparators enabled, the 
value of the LSA comparator will be immediately displayed so that you can see if 
any unwanted bits are set in the lower word of the LSA comparator. 

To avoid confusion resulting from the fact that the LSA comparator can contain 
address, status, and LSA information in this mode, the statement: 



WHEN NOT ACn THEN . . . 



8-55 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



is not allowed and results in an error message. Sirniliarly, the statement: 



WHEN ACn AND NOT LSA THEN . . . 



will not be accepted. The generla nil of thumb is "If you aren't sure about whether a 
certain WHEN/THEN statement is nonambiguous, try it." If you receive an error 
message of the form 

[comparator combination] : CAN'T PROCESS IN THIS MODE 

then you'll have to try to more precisely state your goal, possibly requiring more than 
one WHEN/THEN statement. For more complicated events, you may want to disable 
32 bit comparators and enter your WHEN/THEN statement in regular mode. 

The status comparators (SI and S2) may be set up with a variety of different 
conditions to further qualify your particular event action. The acceptable status 
mnemonics are: 



BYT or WRD 
RD or WR 
TAR or OVL 

Any one of the function codes SCO 

SC1/UD 
SC2/UP 
SC3 
SC4 

SC5/SD 
SC6/SP 
SC7/CPU 

BER 

Any one of the interrupt priorities, IPO through IP7 

AV (autovector) 

IP (interrupt pending) 
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When setting up a status comparator, the following examples are acceptable: 



S1=BYT 

Sl=RD+OVL 

S2=BER+TAR 

S2=SC4+RD+BYT 

S1=IP4 



As you can see, multiple choices for the status comparators are allowed, however, 
only one from each category should be used. For example, you should not set the 
status comparator to BYT+WRD, RD+WR, or SD+SC4 because this combination of 
status signals would not happen simultaneously. 

Therefore, SI and S2 can equal the following: 



STATUS MNEMONIC TABLE 



SI = BYT + RD + TAR + SCO + BER + IPO + AV + IP 



SC1/UD 


IPI 


SC2/UP 


IP2 


SC3 


IP 3 


SC4 


IP 4 


SC5/SD 


IP 5 


SC6/SP 


IP 6 


SC7/CPU 


IP 7 



(Only one out of each category) 



8-57 



ES 1800 Emulator User 's Manual for 68000 Series Microprocessors 



The following table shows how the status bits are used in the status comparator: 







STATUS 


COMPARATOR 


BREAKDOWN 




14 13 12 


11 


10 


9 8 7 


6 5 4 3 


2 10 


1 1 1 


\ 


1 


/ 1 


\ 1 / 


1 1 1 


1=IP 1=AV 




0=IP0 


1=BER 


o=sco 


0=O VL | | 






1-IP1 




1=SC1/UD 


1=TAR | | 






2=IP2 




2=SC2/UP 


0=WR | 






3=IP3 




3=SC3 


1=RD | 






4=IP4 




4=SC4 


0=WRD 






5=IP5 




5=SC5/SD 


1=BYT 






6=IP6 




6=SC6/SP 








7=IP7 




7=SC7/CPU 
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An example of a mode 3 trace display follows: 



>DRT 



LINE 


ADDRESS 




DATA 


R/W 




FC 


IPL 


LSA - O 


TIME 




#20 


FFF21C5E 


< 


FFFB 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.183 


MS 


#19 


FFF21C60 


< 


0040 


w 


TAR 


SD 


O 


IP 


%111111 


500 


.184 


MS 


#18 


FFF21C5A 


< 


FFF2 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.184 


MS 


#17 


FFF21C5C 


< 


0422 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.185 


MS 


#16 


FFF21C56 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.186 


MS 


#15 


FFF21C58 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.186 


MS 


#14 


FFF21C52 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.187 


MS 


#13 


FFF21C54 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.188 


MS 


#12 


FFF21C4E 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.188 


MS 


#11 


FFF21C50 


< 


0008 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.189 


MS 


#10 


FFF21C4A 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.190 


MS 


#9 


FFF21C4C 


< 


00FE 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.190 


MS 


#8 


FFF21C46 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.191 


MS 


#7 


FFF21C48 


< 


0003 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.192 


MS 


#6 


FFF21C42 


< 


0000 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.192 


MS 


#5 


FFF21C44 


< 


0003 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.193 


MS 


#4 


FFF21C3E 


< 


0014 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.193 


MS 


#3 


FFF21C40 


< 


oooc 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.194 


MS 


#2 


FFF21C3A 


< 


0000 


w 


TAR 


SD 


0 


I? 


%111111 


500 


.195 


MS 


#1 


FFF21C3C 


< 


0001 


w 


TAR 


SD 


0 


IP 


%111111 


500 


.195 


MS 



#0 BREAK 



NOTE 

The LSA bits will not appear in trace with the 25 MHz 68020. 
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Pod Connections 

CAUTION 

Each trace mode requires different pod connections for proper operation. 
Make sure that all three cables from the pod are securely connected 
before operating the ES 1800. The smaller cable is always attached in 
the connector marked "Logic State Probe" on the front panel of your ES 
1800 (unless you are using the optional logic state analyzer - see the 
next paragraph). The larger cables are attached to the connector marked 
"Emulator Pod" on the front panel of your ES 1800 (be sure to match the 
Jl and J2 connectors to the proper sockets). 

The logic state analyzer option works only in trace mode 0 with the 25 MHz 68020 
pod, and only in trace modes 0 and 3 with the 16 MHz 68020 pod. To use the 
optional logic state analyzer with the 25 MHz 68020 pod in trace mode 0, disconnect 
the smaller cable from the ES 1800 and replace it with the cable from the logic state 
probe. 

To use the optional logic state analyzer with the 16 MHz 68020 pod in trace mode 0, 
disconnect the smaller cable from the ES 1800 and replace it with the cable from the 
logic state probe. To use the optional logic state analyzer with the 16 MHz 68020 
pod in trace mode 3, connect the LSA pod to the 68020 pod face plate. Trace mode 1 
does not require the logic state analyzer. 

The following table shows the proper connections of the 68020 pod and optional 
logic state analyzer to the ES 1800 base unit for all trace modes. 

25 MHz 68020 Pod: 



Trace Mode 


Large cables 


Small cable 


LSA Pod 




connected to 


connected to 


connected to 


0 


ES 1800 


Unconnected* 


ES 1800 


1 


ES 1800 


ES 1800 


N/A 


2 


ES 1800 


ES 1800 


N/A 


3 


ES 1800 


ES 1800 


N/A 
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16 MHz 68020 Pod: 



Trace Mode 


Large cables 


Small cable 


LSAPod 




connected to 


connected to 


connected to 


0 


ES1800 


Unconnected* 


ES 1800 


1 


ES 1800 


ES 1800 


N/A 


2 


ES 1800 


ES 1800 


N/A 


3 


ES 1800 


ES 1800 


68020 pod 



* If the LS A pod option is not used, the small cable from the 68020 pod 
may remain connected to the ES 1800. 



Timestamp Information 

The ES 1800 68020 automatically records timestamp information on all traced bus 
cycles. You can display this timestamp information in either of two resolutions - 
normal resolution using the DRT command, or high resolution using the DST 
command. 

With the timestamp information, you can check the performance of various modules. 
Time spent between or in subroutines can be determined. Further, you can measure 
the amount of time between accesses to a particular memory location, or between any 
two events definable with the Event Monitor System. 

To use the timestamp information, you must trace the bus cycles that contain the 
starting and ending events you are interested in. Then you simply determine the 
difference in the timestamp values to find the duration of time between the events. 

Follow this procedure: 

1. Use the EMS to trace one bus cycle at the beginning of the event (for instance, 
at a specific address using the address comparator or for given data using the 
data comparator). 

2. Use the EMS to trace one bus cycle at the end of the event 

3. Run your code so that both starting and ending points are executed. 

4. Stop the emulator and examine the trace memory using the resolution needed 
(DRT or DST commands). 
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5. Subtract the starting timestamp value from the ending timestamp value to 
determine the elapsed time. 

If the interval is short enough, you may be able to break on the ending event and the 
use the STA, STD, or STS commands to search for the starting event in trace. 

You can also use the TIM command to change the frequency of the emulator's 
timestamp clock (see Section 5). 
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Event Monitor System Examples 

There are three examples shown on the following pages: 

1. Using the trigger out action to display the duration of a software routine on an 
oscilloscope. 

2. Using the force special interrupt action to safely stop a mechanical system. 

3. Debugging a suspected problem in a belt jam routine that uses reentrant code. 

Some of these examples use the symbolic debug option, which lets you substitute 
unique, meaningful names for numeric values. 

Example 1 

The trigger out action (TGR) can be used to trigger a logic analyzer, oscilloscope or 
counter-timer. In this example, it is used to display the duration of a software routine 
on an oscilloscope. 

Three actions are done at the same time in this example. When the routine starts, 
trace is turned on (TRC), the trigger out is started (TGR), and we switch to event 
group 2 (GRO 2). Note the use of symbols: the symbols 'sub_start and 'sub_end. 

Figure 8-7. Oscilloscope Display of Software Routine Duration 



>ACl = 'sub_start 
> AC 1.2 = 'sub_end 
>DC1.2 = OXXXX 

>WHEN AC1 THEN TRC, TGR, GRO 2 


Set an address comparator in group 1 (AC1) to the 
subroutine's start address. 

Set an address comparator in group 2 (AC 1.2) to the 
subroutine's end address. 

Set a data comparator (DC 1.2) to don't cares (XXXX) 

to keep the trigger high. 

In group 1 , at the beginning of the 

subroutine, start the trace (TRC), set the trigger 

high (TGR) and switch to group 2 (GRO 2). 


>2 WHEN DC1 THEN TGR 
>2 WHEN AC1 THEN GRO 1 


In group 2, use DO as a dummy value, 

used to keep the trigger high during the subroutine. 

Since trace is not qualified in this group, all bus cycles 

in this group will be traced. 

At the subroutine end (AC 1.2), return to group 1 

and stop the trace and trigger pulse. 



Example 2 

The problem with debugging a mechanical system like a robot arm is that any 
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interruption to the controlling software may cause the system to physically crash. 
The Event Monitor System provides a special interrupt system so that when a 
specified breakpoint is reached, a soft shutdown routine can safely stop the 
mechanical system, and only then is the program stopped to locate the problem. 

Figure 8-8. Safely Debug a Problem with a Robot Arm by Jumping 
to a Specified Address and Executing a Soft Shutdown 



>SIA = 'shut_down 


Set the special interrupt address (SIA) to the address 




of the soft shutdown routine, specified by the symbol 




"shut_down. 


>ACl = $7F4E2 


Set the first address comparator (AC1) to the address 




of the suspected problem where you want to break 




emulation. 


>AC2 = 'shut_down + 4E 


Set the second address comparator (AC2) to the end 




of the soft shutdown routine 


>WHEN AC1 THEN FSI 


When you get to the address where you want to break, first 




execute the forced special interrupt (FSI). 


>WHEN AC 2 THEN BRK 


When you get to the end of the *shut_down routine, break 




emulation (BRK). 


>RBK 


Run to the breakpoint. 



Example 3 

In this example, debugging a suspected problem in a belt jam routine requires 
debugging reentrant code. The state diagram identifies the route of suspected trouble: 
the problem occurs only after initialization, when the specified belt is stuck (belt C 
on conveyor 2), and the jam routine is called with a particular value. 

Note that the program continues to execute in real-time while several events isolate 
the problem. The breakpoint is set only after the exact program state is identified. 
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Figure 8-9. Debugging a Problem in a Belt Jam Routine 





Command 


Description 


ACl = 


'end_init 


Group 1 is used to step over the initialization routine. 


WHE ACl THE GRO 2 


This is done to make sure that initialization is complete. 


ACl. 2 


= 'conveyor2 


Group 2 is used to specify that you are only interested 


2 WHE 


ACl THE GRO 3 


in when conveyor#2 calls the routine that checks 






the belts. 


ACl. 3= 


= 'checkbelts 


Group 3 is used to specify that the checkbelt routine 






has identified that belt C is the one with the 






problem. This is specified in your code by bit 3 at 






the address 'checkbelts. 


DC1.3 


= 0004 DC 0FFF7 


Use the data comparator (DC 1.3) to specify the value 






read at the address AC1.J. UUU4 DC Urrr / means to check 






bit 3 of the data word (0004), and ignore the other 






bits (DC 0FF7). 


SI. 3 = 


= RD 


Use the status comparator (S1.3) to qualify only 






reads irom address AL.1.J. 


3 WHE 


ACl AND DC1 AND SI 


THE RCT, GRO 4 






When all these conditions are met, 






it is time to go to group 4 (GRO 4) and to reset the 






counter (RCT) so you can use it in group 4. 






Group 4 is used to identify the portion of the 






beltjam routine which you suspect contains the problem. 


ACl. 4 


= 'belt jam LEN 400 


Set the address comparator in group 4 (AC 1.4) to a 






range which starts at the beginning of the beltjam 






routine. 


SI. 4 = 


= SP 


Use the status comparator (S1.4) to monitor for an 






JIlMJUwLiuiI ICLwIl aUpciYlaUI piuglalll spat^C ill 






the range AC 1.4. 


CL.4 = 


= #100 


Set the count limit to 100, so that you can break 






after the first 100 instruction fetch cycles in the routine. 






This assumes that you suspect the problem is in 






these instructions. 


4 WHE 


ACl AND SI THE CNT 


When you're in the beltjam routine, increment the 






counter at every instruction fetch cycle. 


4 WHE 


CL THE BRK 


When the count limit is reached, then break. 


RBK 




Run to the breakpoint. The events leading up 






to the breakpoint are checked while the 






software is running in real time. 
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Event Monitor System Commands 

There are two commands explicitly for the Event Monitor System: DES (Display 
Event Statements) and CES (Clear Event Statements). These commands are 
described on the following pages. 
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Display Event Statements 



Command Result 



DES 



DES <group number> 



Displays all of the WHEN/THEN 
statements currently active from all 
groups. Statements are numbered with the 
group number and the statement number 
within the group. 

Displays all of the WHEN/THEN 
statements and the comparator values for 
the specified group. Statements are 
numbered with the group number and the 
statement number within the group. 



Examples 



Display the statements and comparators for groups 1 and 2. WHEN/THEN statements 
are numbered in the following fashion: 

<group number>,<statement number> 

Statement numbers are relative only to the assigned group. An example follows. 
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Figure 8-10: Results of the DES command 



>DES 1; RET, -DES 2 

1.1 WHEN AC1 THEN BRK 

1.2 WHEN AC 2 AND S2 THEN BRK 



AC1 


1 




$007632 


AC 2 


1 




$000000 


DC1 


1 




$0000 


DC2 


1 




$0000 


SI 


1 




$0000 


S2 


1 




$0000 


LSA 


1 




$0000 


CL 


1 




$0000 



2.1 WHEN SI AND DCl THEN CNT, TRC 

2.2 WHEN CL THEN BRK 



AC1 


2 




$000000 




AC 2 


2 




$000000 




DCl 


2 




$4 OFF DC 


$00FF 


DC2 


2 




$0000 




SI 


2 




$0003 DC 


$FFFC 


S2 


2 




$0000 




LSA 


2 




$0000 




CL 


2 




$0010 
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Command Result 



CES 

CES <group nwnber> 



Clears all of the WHEN/THEN statements 
currently active. 

Clears all of the WHEN/THEN statements 
in the specified group. 



CES <group number>,<statement number> 

Clears the specified WHEN/THEN 
statement in the specified group. Since 
the statement numbers within a group are 
relative to other statements in that group, 
your deletion of one or more statements 
may change the statement numbers of 
other statements. After each such 
deletion, the new statement numbers are 
redisplayed automatically. 



Comments 



The comparator values are not affected by the CES command. There is no practical 
need to clear comparators, since you simply don't use the comparators that are not 
relevant to your current task. 
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Shortcuts for Setting Up 

This section contains helpful macros designed to ease the process of setting up the 
Event Monitor System in each trace mode. Please read all of this information before 
using it. You can use the examples as is or you may find another combination of 
commands to accomplish your task. 

These examples assume you are familiar with macros and their use (page 5-116). 
Though the following macros use GD0 and GDI, you may use any of the general 
purpose registers (pages 5-85 and 5-87). You must re-enter the macro each time you 
power up the ES 1800. 

ModeO 

Mode 0 is relatively easy to set up when using the Event Monitor System. To set up 
the address comparators, simply use the lower 24 bits of the address. To set up the 
data comparators, use the following macro: 



_1=DC1=GD0» #16 

GDO=XXXXXXXX (32 bit data pattern you are using) 
1 



Set GDO to a 32 bit data pattern and execute macro #1. The data comparators will 
only utilize the upper 16 bits. This macro will shift the data pattern to the right 16 
places and place the new value into DC1. 

The Event Monitor System can now be set up. For example: 



>WHEN " DC 1 THEN BRK 



Mode 1 

Mode 1 uses the LS A comparator and the data comparators to set up a full 32 bit data 
value. Use the following macro to set up a data comparator: 
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_1=LSA=GD 0 ; DC 1=GD0» # 1 6 

GDO=XXXXXXXX (32 bit data pattern you are using) 
1 



Set GDO to a 32 bit pattern and execute macro #1. The data comparator will utilize 
the upper 16 bits and the LS A comparator will utilize the lower 16 bits. Note that this 
is effectively done for you with 32 bit comparators enabled. 

The Event Monitor System can now be set up. For example: 



>WHEN DC1 AND LSA THEN BRK 



Mode 2 

(Please refer to Mode 1 for setting up the data comparator.) 

To set up the address comparator, you will need to use an address comparator and a 
status comparator. 



_1=AC1=GD1;S1=( (GD1»#17) &$7F80) DC $807F 
GD1=XXXXXXXX (32 bit data pattern you are using) 
1 



This macro will place the lower 24 bits into AC1. Next, GDI will be shifted 17 
(decimal) times to align adddress bits 24-31 to SI bits 7-14. Next, it is 'ANDED' 
with $7F80 to zero out the lower bits. Finally, a don't care mask is added so the SI 
comparator will not expect to include bits 0-6 in the event comparison. This 
manipulated information will be placed into SI. Note that this is effectively done for 
you with 32 bit comparators enabled. 

The Event Monitor System can now be set up. For example: 



>WHEN AC1 AND SI THEN BRK 



To extend the address to a range, after the macro has been executed, use the 
following syntax: 
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ACl=ACl LfciN XXXXXX 



You will not be able to extend the range to the upper 8 bits since they are residing in 
a status comparator. Ranges are not allowed in the status comparators. 

To include any of the other status bits (i.e. BYT/WRD or TAR/OVL), after the macro 
has been executed, use the following syntax: 



S1=S1+BYT 
S1=S1+TAR+IP3 



Mode 3 



_l=ACl=GD0;LSA= ( (GDO>>#16) &$FF00) DC $FF 
GD0=XXXXXXXX (32 bit data pattern you are using) 

1 



This macro will place the lower 24 bits into AC1. Next, GD0 will be shifted 16 
(decimal) times to align adddress bits 24-31 to LSA bits 8-15. Next, it is 'ANDED' 
with $FF00 to zero out the lower bits. Finally, a don't care mask is added so the LSA 
comparator will not expect to include bits 0-7 in the event comparison. This 
manipulated information will be placed into the LSA comparator. Note that this is 
effectively done for you with 32 bit comparators enabled. 

The Event Monitor System can now be set up. For example: 



>WHEN AC1 AND LSA THEN BRK 



To extend the address to a range, after the macro has been executed, use the 
following syntax: 



AC1=AC1 LEN XXXXXX 



You will not be able to extend the range to the upper 8 bits, since they are residing in 
an LSA comparator. Ranges are not allowed in LSA comparators. 
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ES Language Mnemonics 



ES Language Commands 



Mnemonic 


Description 


Page 


> 


emulation pause mode prompt 


4-25 


R> 


emulation run mode prompt 


4-25 


<return> 


Return 


4-6 


/ 


repeat previous command line 


4-6 


5 


statement separator 


4-6 


* 


repeat command 


4-6 


CTRLQ 


start screen scrolling (can be changed) 


4-28 


CTRLS 


stop screen scrolling (can be changed) 


4-28 


CTRL X 


delete line 


4-27 


CTRL R 


reprint current line 


4-27 


CTRL Z 


reset the emulator 


4-27 


ESC ESC 


escape transparent 


4-28 


$ 


hexadecimal 


4-10 


# 


decimal 


4-10 


% 


binary 


4-10 


\ 


octal 


4-10 




equals 


4-10 


0 


parentheses 


4-8 
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indirection 


4-8 


* 


multiplication or repeat 


4-14 


1 


division 


4-14 


+ 


addition 


4-14 




subtraction 


4-14 




negation 


4-14 


& 


bitwise AND 


4-14 




bitwise OR 


4-14 


« 


shift left 


4-14 


» 


shift right 


4-14 


t 


inverse, bitwise NOT 


4-14 


: 


memory block attribute 


6-15 




increment Memory Mode address 


6-46 




execute macro 2 


5-118 


J 


decrement Memory Mode address 


6-46 


) 


execute macro 1 


5-118 




help menu 


4-18 




error query 


4-7 




define/execute macro 


5-118 


9 


symbol definition (single quote) 


4-9 


.B 


dot operator, byte mode 


4-26 


.W 


dot operator, word mode 


4-26 


.L 


dot operator, long word mode 


4-26 


A(0-6) 


address register (0-6) 


5-68 


ABS 


absolute value 


4-14 


AC1, AC2 


address comparators 1 and 2 


7-3, 8-2 


AND 


logical event "AND 


4-13 


ALL 


status constant 


5-63 


ASM 


line assembler 


6-34 


BAS 


display base value 


5-77 


BFMT 


bus error register 


5-73 


BMO 


block move 


6-24 


BRK 


break 


7-15, 8-16 


BTE 


bus timeout enable switch 


5-13 
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BUS 


display status of lines 


6-81 


BYM 


byte mode 


4-26 


BYT 


byte access status 


7-5, 8-9 


CAAR 


cache address (68020) 


5-69 


CACR 


cache control (68020) 


5-69 


CAS 


continuous address strobe switch 


5-14 


CCT 


serial port control 


5-36 


CDS 


cache disable switch (68020) 


5-15 


CES 


clear WHEN/THEN statements 


7-14, 8-26 


CL 


count limit 


7-8, 8-11 


CLK 


read target system clock 


6-79 


CLM 


clear memory map 


5-62 


CLR 


clear microprocessor data registers 


5-74 


CLT 


clear trace memory (68020) 


5-100 


tJVIL 


clear macros 


< ion 


CNT 


count event 


7-20, 8-17 


COM 


Communication with target 


5-46 


CPU 


CPU space 


5-64 


CPY 


copy switch 


5-16 


CRC 


target cyclic redundancy check 


6-80 


CYC 


cycle (68010) 


5-70 


D(0-7) 


data registers (0-7) 


5-68 


DB 


display memory block 


6-17 


DBP 


disable bus error switch 


5-17 


DC 


don't cares 


4-9 


DC1,DC2 


data comparators 1 and 2 


7-4, 8-2 


DEL 


delete symbol/section 


5-131 


DES 


display WHEN/THEN statements 


7-12, 8-67 


DFB 


default base register 


5-69, 5-83 


DFC 


destination function code register(68010) 


5-69 


DIA 


display ASCII character string 


5-50 


DIB 


bus error register 


5-71, 5-73 


DIS 


display disassembled memory 


6-39 


DM 


display memory map 


5-53 


DNL 


download 
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DOB 


bus error register 


« T1 < T7 

/ x, u i D 


UK 


display microprocessor registers 




DRT 


display raw trace memory 


5-92 


DST 


display raw trace memory 


5-107 


Dl 


disassemble trace memory 


5-101 


DTB 


disassemble trace memory backward 


5-115 


DTF 


disassemble trace memory forward 


5-115 


ECS 


external cycle start switch (68020) 


5-18 


END 


exit line assembler 


4-27 


FA 


bus error register 


5-71, 5-73 


FIL 


fill memory with constant data 


6-21 


FIN 


find data in range 


6-19 


FMT 


bus error register 


5-71 


FSI 


force special interrupt 


7-25, 8-19 


*sr 


fast interrupt enable switch 


5-19 


FTO 


fast bus timeout switch 


5-20 


GDO-7 


general purpose data registers (0-7) 


5-69, 5-85 


GRO-7 


general purpose range registers (0-7) 


5-69, 5-87 


GRO 


event monitor system group 


7-27, 8-22 


IDX 


repeat index register 


5-69, 5-122 


HB 


bus error register 


5-71 


ILG 


illegal memory access attribute 


5-56 


IM 


introspective mode switch 


5-21 


ID/A m\ 


interrupt levels 


I-J 


IPS 


bus error register 


5-73 


IR(1-16) 


bus error registers 


5-73 


IRA 


internal range 


4-9 


IR(A-G) 


bus error registers 


5-73 


ISP 


interrupt stack pointer 


5-69 


LD 


load EEPROM data 


5-28 


LDV 


load vectors 


6-9 
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LEN 


length 


4-9 


LIM 


repeat limit register 


5-69, 5-122 


LOV 


load overlay memory 


5-65 


LSA 


Logic State Probe comparator 


7-4, 8-10 


LST 


decrements address in memory mode 


6-46 


LWM 


long word mode 


6-15 


MAC 


display macros 


5-117 


MAP 


define overlay memory map 


5-55 


M 


enter memory mode 


6-42 


MMD 


access status register 


5-79 


MMP 


memory mode pointer 


5-69, 5-81 


MMS 


memory mode status 


5-69, 5-81 


MOD 


modulo 


4-15 


MSK 


bus error register (68010) 


5-71 




master stack pointer (68020) 


j-oy 


NOT 


logical event NOT 


4-13 


NXT 


increment address in memory mode 


6-46 


ocs 


operand cycle start 


5-18 


OFF 


disable switches 


5-10 




cnaoicb swiicnes 




OR 


logical event OR 


4-13 


OVE 


overlay memory enable 


5-63, 5-69 


UVL, 


overlay memory access 


/-J 


ovo 


MMS/MMD attribute 


5-79 


ovs 


overlay memory speed 


5-67 


PC 


program counter register 


5-68, 5-71,5-73 


PPT 


peek/poke trace switch 


5-22 


PUR 


clear symbolic memory 


5-132 


R(0-14) 


bus error registers 


5-71 


RBK 


run with breakpoints 


6-5 


RBV 


load reset vectors and run breakpoints 


6-5 


RCT 


reset count limit 


7-20, 8-17 


RD 


read access status 


7-5, 8-9 
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RET 


execute line feed and return 


5-135 


REV 


display firmware revision 


5-134 


RNV 


run with new vectors 


6-6 


RO 


read only attribute 


5-55 


RST 


reset target system 


6-14 


RUN 


run emulation 


6-6 


RW 


read/write attribute 


5-55 




status comparators l ana z 


f-D, o-Z 


SAV 


save EEPROM data 


5-26 


SBA 


bus error register 


5-73 


SC(0-7) 


space code status 


7-5, 8-9 


SD 


supervisor data 


5-63 


SEC 


display section 


5-128 


SET 


set/display system parameters 


5-3 


SF(0-3, 10-17, 


special functions 


6-50 


20, 40-49) 






SFC 


source function code register (68010) 


5-69 


SIA 


special interrupt address 


7-25, 8-19 


SLO 


slow interrupt enable switch 


5-19 


SP 


supervisor program 


5-63 


SPD 


view bus speed info switch 


5-23 


SR 


status register 


5-68, 5-71, 5-73 


SSP 


supervisor stack pointer register 


5-68 


SSW 


bus error register 


5-71, 5-73 


CTA 


search raw trace for address 


J-114 


STD 


search raw trace for data 


5-114 


STS 


search raw trace for status 


5-114 


STP 


step and stop 


6-8 


SYM 


display symbols 


5-127 


SZ 


value display 


4-26 


TAD 


tri-state address switch 


5-24 


TAR 


target access 


5-113 


TCE 


trace acquisition switch 


5-25 


TCT 


terminal control 


5-35 


TGO 


MMS/MMD attribute 


5-79 
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TGR 


enable trigger output 


7-24, 8-21 


TGT 


target system memory attribute 


5-56 


THE 


then 


7-2 


TTM 

X XI tX 


Spiff t Timer Prffliip nev 


5-105 


TO 


to 


4-9 


TOC 


toggle counting 


7-21,8-17 


TOT 


toggle trace memory 


7-17,8-22 


TRA 


transparent mode 


5-33 


TRC 


trace event 


7-17, 8-22 


TST 


test register for reoeats 


5-69, 5-89 


UD 


user data 


5-64 


UP 


user program 


5-64 


UPL 


upload 


5-43 


UPS 


upload symbols 


5-44 


USP 


user stack pointer register 


5-68, 5-69 


VBL 


vprifv HlnrV Hata 

vssLLLj UiV/v-iV Kioto, 


6-22 


VBM 


verify block move 


6-27 


VBR 


vector base register (68010/20) 


5-69 


VFO 


verify overlay memory 


5-66 


VFY 


verify serial data 


5-42 


VM 


valid memory address status 


7-5 


VP 
Vr 


vaiiQ penpnerai address siaius 


/-J 


WAI 


wait 


6-11 


WDM 


word mode 


4-26 


WHEN/THEN 


WHEN/THEN Statements 


7-2, 8-2 


WR 


write access status 


7-5,8-9 


WRD 


word access status 


7-5, 8-9 


X 


don't care 


4-9 


X 


exit memory mode 


6-45 


XRA 


external range 


4-9 
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ERROR MESSAGES 



The ES 1800 software generates two basic types of error messages. ES Language 
syntax and operational errors in a command line are indicated by a beep (BEL code). 
The next line displayed contains a single ? underneath, and usually just after, the 
place in your command line that caused the error. At the point the error is detected, 
the remainder of the command line is discarded. For example, the DRT command is 
invalid during emulation: 



>WHE AC1 THE BRK; RBK; DRT; DR 
<BEL> ? 
R> 



The RBK command was executed, but the DR command was not Whenever you see 
an error message of this type, you can enter a single ?. The ES 1800 responds with a 
text message explaining the error. For the above example: 



R>? 




ERROR 


#56 


TRACE 


DATA IS INVALID DURING EMULATION 


R> 





The second type of error message is caused by target hardware problems. There are 
various conditions that can occur in the target that prevent the pod processor from 
operating. If these error messages are displayed, the problem must be remedied 
before the ES 1800 can be used. 
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ES Language Error Messages 

1 23 EXPRESSION HAS NO MEANINGFUL RELATION 

TO REST OF COMMAND. 

Often caused by entering symbols out of context. DR 
and BRK are both legal, but when entered together as 
DR BRK, this error message is generated. 

4 PARSE ERROR. . .CALL AMC. 

5 UNDEFINED SYMBOL OR INVALID CHARACTER 

DETECTED. 

Usually caused by improper spelling. 

6 CHECKSUM ERROR IN DOWNLOAD DATA. 

The last record received was in error. Make sure that 
the format selected in the system setup is the same as 
the format of the received data. Refer to download 
command (DNL) for error handling during computer 
control. 

7 BAD STATUS = ...RETURNED FROM EMULATOR 

CARD. 

Contact Customer Service. 

8 ARGUMENT IS NOT A SIMPLE INTEGER OR 

INTERNAL RANGE. 

Don't cares are not allowed in this context. 

9 NO MORE OVERLAY MEMORY AVAILABLE. 

You have not cleared the map or you are trying to 
map in more memory than is allowed. Contact 
Applied Microsystems Corporation for optional 
overlay memory expansion. 

10 MULTIPLE-DEFINED EVENT GROUP. 

Only one group may be referenced in any event 
clause. Error is caused by trying to mix event register 
groups in an event clause. (Example: 
2 WHEN AC1 3 THEN BRK would cause this 
error). 

11 ILLEGAL ARGUMENT TYPE FOR EVENT 

SPECIFICATION. 

Only the 8 event comparators may be used in the 
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event portion of a WHEN/THEN statement. 

12,13 ARGUMENTS MUST BE A SIMPLE INTEGER. 

Don't care masks and ranges not allowed. 

14,15,16 OPERATION INVALID FOR THESE ARGUMENT 

TYPES. 

Usually caused by attempting arithmetic operations 
on incompatible variables. 

(Example: (4 DC 9) + (IRA 500 to 700).) Same as 
error 23. 

1 7 SHIFT ARGUMENT CANNOT BE NEGATIVE. 

To shift a value in the reverse direction, use the 
opposite shift operator, (» or «), not a negative 
shift value. 

18 TOO MANY ARGUMENTS IN LIST ... (9 MAX). 

When entering data in memory, a list of only 9 values 
can be entered on a single command line. 

19 INVALID GROUP NUMBER . . . (NOT IN 1-4). 

There are only four event groups (1-4). 

20212223 OPERATION INVALID FOR THESE ARGUMENT 

TYPES. 

Often caused by attempting arithmetic operations on 
incompatible variables. 

24 BASE ARGUMENT MUST BE A SIMPLE 

INTEGER. 

Argument should be #0 to #16. 

25 ILLEGAL OVS VALUE . . . (NOT IN 1-7). 

Overlay speed determines the number of wait states 
inserted for overlay accesses. Only 1-7 are allowed 
with your emulator type. See also Error #97. 

26 RANGE TYPE ARGUMENT NOT ALLOWED AS 

DATA. 

Data can only be expressed as masked values or 
integers. 

27 ADDRESS ARGUMENT MUST BE A SIMPLE 

INTEGER. 

Cannot use ranges or masked values. 
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28 ATTEMPT TO CHANGE CURRENT OVERLAY 

SEGMENT (USE CLM FIRST). 

Overlay memory can only be mapped within a 16 
megabyte range. 

29 ILLEGAL DESTINATION - SOURCE TYPE MIX. 

Caused by trying to store don't care data into a range 
variable or other similar operations. 

3031 RANGE START AND END ARGUMENTS MUST 

BE SIMPLE INTEGERS. 
Cannot use masked values or ranges. 

32 RANGE END MUST BE GREATER THAN RANGE 

START. 

6 len 1 and 10 to 5 are examples of invalid ranges. 

33 RANGE START AND END ARGUMENTS MUST 

BE SIMPLE INTEGERS. 

Cannot use masked values or ranges. 

34 READ AFTER WRITE-VERIFY ERROR. 

Data supposedly written to memory during a 
download operation was read back as a different 
value. The error message contains the locations and 
results of the comparison. 

35 WARNING - DATA WILL BE LOST WHEN 

EMULATION IS BROKEN. 

Caused by assigning values to CPU registers during 
emulation. CPU registers are copied into internal 
RAM only when emulation is broken. The RAM 
contents are copied into the processor only when 
emulation is begun. The ES 1800 cannot access CPU 
registers during emulation. Thus, once emulation has 
been started the DR command shows the contents of 
the CPU registers as they were before emulation was 
begun. Changes can be made to these values, but the 
data will be rewritten when emulation is broken. 

363738 NO ROOM . . . BREAKPOINT CLAUSES TOO 

NUMEROUS OR COMPLEX. 
Too many WHEN/THEN clauses were entered. The 
number of sentences cannot exceed the available 
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RAM in ESL. This is different for each of the 
microprocessors supported. 

39 INVALID GROUP NUMBER . . . (NOT IN 1-4). 

There are only four groups in the Event Monitor 
System. 

40 ILLEGAL SELECT VALUE. 

Variable cannot be assigned value specified. Check 
manual. 

41 INCORRECT NUMBER OF ARGUMENTS IN LIST. 

Check command argument list. 

42 ILLEGAL SETUP SET VALUE. 

Consult SET menu for legal values (page 5-3). 

43 WHEN CLAUSE REDUCED TO NULL 

FUNCTION. 

Caused by constructs such as WHEN AC1 AND 
NOT AC1. 

44 INTERNAL ERROR . . . NULL SHIFTER FILE. 

Contact Customer Service. 

45 MAP CANNOT BE ACCESSED DURING 

EMULATION. 

The map hardware is constantly used by the 
emulating processor during emulation and cannot be 
accessed. 

46 ARGUMENT MUST BE AN INTERNAL RANGE. 

External ranges and masked values not allowed. 

47 16-BIT RANGE END LESS THAN START. 

Invalid range. 

48 ILLEGAL MODE SELECT VALUE. 

49J0 INVALID GROUP NUMBER . . . (NOT IN 1-4). 

Must be 1 through 4. 

51 SAVE/LOAD INVALID ARGUMENT VALUE. 

Valid arguments include 0 through 5. 

53 EEPROM WRITE VERIFY ERROR. 

Data in the EEPROM is verified during the SAV 



B-5 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



operation. (The store operation is retried many times 
before this error is generated.) EEPROMs have a 
finite write cycle life. The EEPROM in your ES 1800 
is warrantied for one year. Contact Customer Service. 

54 ATTEMPT TO SAVE/LOAD DURING EMULATION. 

These commands may only be used while in the pause 
mode. 

55 EEPROM DATA INVALID DUE TO INTERRUPTED 

SAVE. 

Previous SAV command was interrupted by a reset or 
power off. 

56 TRACE DATA IS INVALID DURING EMULATION. 

Viewing of the trace is only allowed during pause 
mode, or if the optional dynamic trace feature is used. 

57 INVALID GROUP NUMBER (NOT 1-4). 

Must use 1 - 4. 

58 IMPROPER NUMBER OF ARGUMENTS. 

Check command argument list. 

59 ARGUMENT MUST BE AN INTERNAL RANGE. 

External ranges and masked values not allowed. 

60 ARGUMENT MUST BE A SIMPLE INTEGER. 

Ranges and don't care masks not allowed. 

61 IMPROPER NUMBER OF ARGUMENTS. 

Check command argument list. 

62 CANNOT STORE THIS VARIABLE DURING 

EMULATION. 

Must be in pause mode. 

63 ILLEGAL ARGUMENT TYPE. 

64 ARGUMENT TOO LARGE. 

Caused by entering DRT argument that includes 
numbers greater than #2045. 

65 ILLEGAL RANGE. 

66 STATUS CONSTANTS CANNOT BE ALTERED. 

System constants (i.e., BYT, OVL) cannot be assigned 
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66 STATUS CONSTANTS CANNOT BE ALTERED. 

System constants (i.e., BYT, OVL) cannot be assigned 
values. 

67 TOO MANY WHEN CLAUSES. 

You have tried to enter more WHEN/THEN clauses 
than the Event Monitor System can handle. 

68 INVALID DATA FORMAT FOR SYMBOLS. 

Must use Extended Tektronix Hex. 

70 CANNOT INITIALIZE VECTORS DURING 

EMULATION. 

LDV, RNV, and RBV can only be entered in pause 
mode. 

71 MUST BE IN TRACE MODE 2 TO DISASSEMBLE 

TRACE. 

Refer to SET menu and rerun in trace mode 2 before 
using disassembler commands. 

72 INCOMPATIBLE EEPROM DATA. 

Previous data saved to EEPROM was not from an 
680XXES 1800 system. 

74 COMMAND INVALID DURING EMULATION. 

Must be in pause mode. 

75 INVALID RECORD TYPE. 

Download routine received invalid record type code. 

76 NO SYMBOLIC DEBUG. 

The symbolic debug option is not installed in your 
system. Cannot assign symbol and section values. 

78,79,80 TOO MANY SYMBOLS. 

Symbols exceeded available RAM. Purge symbols 
before downloading again. 

81 SYMBOL OR SECTION PREVIOUSLY DEFINED. 

An attempt was made to redefine an existing symbol 
or section. Section definitions cannot overlap. 
Symbols should be purged before downloading. 

82 SYMBOL NAME IN USE. 

Symbol name cannot be used more than once. You 
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must delete a section before assigning it a new value. 

83 TYPE CONFLICT WITH DEFINED SYMBOL. 

Please refer to the Extended Tekhex specification, 
page C-7. 

57 SECTION TABLE FULL. 

Too many symbolic section names have been defined. 

55 INVALID ARGUMENT SIZE. 

Operand doesn't fit into destination register. 

89 INVALID ADDRESSING MODE. 

90 ARGUMENT OUT OF RANGE. 

Usually caused by reference to a "FAR" location 
without declaring "FAR." 

91 INVALID TRAP VECTOR NUMBER. 

92 INVALID OP CODE for 68000/08/10. 

93 INVALID CONTROL REGISTER. 

94 ARGUMENT NOT SYMBOLIC. 

Requires a symbolic argument 

95 ILLEGAL SPACE CODE. 

96 THIS TRACE AND BREAK BOARD CANNOT 

ENABLE/DISABLE TRACE. 

The trace and break board in your ES 1800 chassis is 
not equipped with the dynamic trace feature. 

97 ILLEGAL OVS VALUE . . . (NOT IN 0-7). 

Overlay speed determines the number of wait states 
inserted for overlay accesses. Only 0-7 are allowed 
with your emulator type. See also Error #25. 

98 OVERLAY REQUIRES (MORE) WATT STATES 

At the current CPU clock speed, the OVS (overlay 
speed) must be set higher than the value just entered. 
OVS will be set to its minimum allowed value 
automatically. 

99 USE OF LSA INVALID IN THIS MODE. 

In trace modes 1 and 2, the LSA bits are used to 
monitor the lower 16 bits of a 32 bit data path. You 
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DC* AND NOT DCm: CAN'T PROCESS IN THIS 
MODE. 

In trace modes 1 and 2 with 32 bit comparators 
enabled, the lower 16 bits of both data registers are 
the same. If you need to use this type of construction, 
disable 32 bit comparators. 

NOT AC*: CAN'T PROCESS IN THIS MODE. 
In trace modes 1 and 2 with 32 bit comparators 
enabled, the address comparators use a portion of the 
status comparators to store data. Therefore, the 
statement "NOT ACn" also involves Sn, and the EMS 
will not allow you to compromise possible status 
comparator values If you need to use this 
construction, disable 32 bit comparators. 

ACn AND NOT Sn: CAN'T PROCESS IN THIS 
MODE. 

8 bits of the Sn register are used for the high byte of 
the address in trace mode 2. The EMS will not allow 
you to compromise possible status comparator values. 
If you need to use this type of construction, disable 32 
bit comparators. 

ACn AND NOT LSA: CAN'T PROCESS IN THIS 
MODE. 

In trace mode 3, the upper byte of the LSA register is 
used for high byte of the 32 bit address. The EMS will 
not allow you to compromise possible LSA 
comparator values. If you need to use this type of 
construction, disable 32 bit comparators. 

RANGE MAY NOT EXCEED 24 BITS. 

Range endpoints may not differ in the bit pattern of 

the most significant byte. Re-enter a valid range. 

UNKNOWN ERROR. 
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Target Hardware Error Messages 



CRC ERROR IN BOOT 



CRC ERROR IN 
DISASSEMBLER 



CRC ERROR IN ESL 



EMULATOR CRC ERROR 



MEMORY ACCESS 
VIOLATION 



Indicates a PROM error on the memory control board, 
located in the Emulator chassis. Addresses 1FE000 to 
1FFFFF (level 1) or E000 to FFFF (for testing) on the 
6809 side. 

Indicates a disassembler PROM error on the Emulator 
card, located in the emulator chassis. Addresses 
1C000 to 1FFFF (level 1) or C00O to FFFF (for 
testing) on the 6809 side. 

Indicates a PROM error on the Emulator card, located 
in the Emulator chassis. Addressses 4000 to FFFF on 
the 6809 side. 

Indicates a PROM error on the Emulator card. 
Addresses 8000 to FFFF on the 680XX side. 

NOTE: A cyclic redundancy check (CRC) error 
message displays whenever an internal hardware error 
to the Emulator has occurred. A PROM that is not 
firmly seated or has one of its legs folded under may 
cause a CRC error. If after checking for this a PROM 
malfunction still exists, call the factory, as this may 
indicate a serious problem. 

Indicates that the target program has attempted to 
access an area of target that is mapped illegal (ILG). 

DM will help determine which areas are mapped as 
illegal. 

DRT will help determine where the program was 
making the access. 
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MEMORY WRITE 

VIOLATION Indicates that the target program has tried to write to 

the RAM overlay in an area that is mapped read only 
(RO). 

DM will help determine which areas are mapped read 
only. 

DRT will help determine which address the program 
was writing to. 

PEEK OR POKE 

BUS ERROR Indicates that a bus error was generated during a 

pause mode memory access. A peek bus error would 
refer to a memory read operation. A poke bus error 
would refer to a memory write operation. The bus 
error may have been issued by either the target or the 
emulator. 

The most likely cause of a target-generated poke bus 
error is special purpose target hardware detecting a 
write to illegal space, such as ROM space. To correct 
this situation, either modify the target hardware, use 
the emulator's capabilities to work around the 
situation, or type OFFDBP to disable target bus 
errors during peek and poke operations (see page 5- 
17). To use the emulator's overlay memory to work 
around the problem, see the following example: 
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Example 



Step 1. MAP <addressl> to <address2> :RO 

Map overlay over the illegal area, and 

Step 2. MMS = <CPU space> + OVO 

Set memory mode status to the appropriate space 
(supervisor or user, program or data: SD, SP, UD, 
UP), and set the "overlay only" option so that peeks 
and pokes go to the overlay, but not to the target. 

If the error is caused by the emulator, the most likely 
cause is a failure to return a DTACK signal 
recognizable by the emulator before an internal 
watchdog timer times out. To correct this situation, 
you may lengthen the timeout of the watchdog timer 
(OFF FTO) if you have a longer DTACK return time, 
or work around the situation using the following 
example: 

Example 



Step 1. MAP <addressl> to <address2>:RO 
Map overlay over the illegal area, and 
Step 2. OVS = <value> 

Set overlay speed to a value between 1 and 7, so that 
it returns its own DTACK. 
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PROCESSOR HUNG Indicates that the Emulator is forcing a break (a single 

step, stopping, or a breakpoint), but the target 
processor is not responding to the 6809. In the 
Emulator, this means the "run to pause" routine was 
interrupted. Issue a reset (CTRL-Z) and look at the 
raw trace (DRT). 

In the 68000/08/10, a PROCESSOR HUNG error can 
occur if an odd value is present in the SSP or VBR 
when the break occurred. When the Emulator goes 
into run mode, the SSP is forced to an even value. In 
the 68010 and 68020, VBR will also be forced to an 
even value. If the program forces the VBR register to 
an odd address when the Emulator attempts to go into 
pause mode, a PROCESSOR HUNG error occurs. 
However, if the stack register in the 68020 has been 
changed to an odd value during run, an 
UNUSED VECTOR 010 message may display after a 
couple of single steps (see below). 

UNUSED VECTOR XXX Indicates a processor-generated error that the 

Emulator is unable to correct. The Emulator returns 
control to the user with a > prompt to wait for further 
commands. The number refers to the vector offset 
listed in the Exception Vector Assignments from 
Motorola. Please refer to the appropriate Motorola 
Microprocessor User' s Manual. 

Indicates that there is no target power. Target power 
is checked before data strobes; therefore data strobes 
may or may not be present The operating system 
prompt returns after this message is displayed, 
permitting user input. 

NO TARGET CLOCK Indicates that there is no clock present at the probe 

tip. The target system is expected to provide a clock 
signal. 



WARNING - 

NO TARGET VCC 
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NO TARGET VCC Indicates that there is no VCC present at the probe tip. 

The target system is expected to provide VCC via the 
probe tip. Check the VCC pin for power. 

The probe tip power is checked before data strobes. 
Therefore, data strobes may or may not be present as 
well as target power. 



Data Strobe Messages 



These messages display whenever the data strobes are halted for more that 220 ms, 
making the user aware of status conditions on the target system. 



BUS TIMEOUT WAITING 

FOR DSACK (68020) Indicates that the present bus cycle has not 

been terminated. Possible causes include program 
execution accessing non-existent memory or address 
space. 

This message does not necessarily indicate an error. 
If the bus cycle is terminated by the target after the 
message is displayed, program execution will 
continue. 

In the event the target does not terminate the cycle, 
use CTRL-Z, then examine raw trace (using DRT) to 
determine the fault. 

Setting ON BTE generates a bus error and breaks 
emulation if the target does not return a DSACK. 
(See page 5-13 for more information.) 
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(68000/08/10) Indicates that the present bus cycle has 
not been terminated. Possible causes include program 
execution accessing nonexistent memory or address 
space. 

This message does not necessarily indicate an error. 
If the bus cycle is terminated by the target after the 
message is displayed, program execution will 
continue. 

In the event the target does not terminate the cycle, 
use CTRL-Z, then examine raw trace (using DRT) to 
determine the fault 

Setting ON BTE generates a bus error and breaks 
emulation if the target does not return a DTACK. 
(See page 5-13 for more information.) 

DOUBLE BUS FAULT Indicates that the processor is halted from the 

processor side due to a double bus fault 

(68008) Double bus faults may be caused by: 

1. Stack memory in non- valid memory space - no 
DTACK returned. 

2. Stack memory in valid memory, but set to an 
ODD address. Example: SSP = 7FFFF should 
beSSP = 80000or7FFFE 

3. Attempting to access non- valid memory. 

EXCESSIVE DMA TIME Indicates that the target bus request, bus grant, or bus 

grant acknowledge signals have been asserted for 
longer than 150 ms. 

This message does not necessarily indicate an error. 
If the other bus master releases the bus after this 
message is displayed, program execution will 
continue. 

In the event this condition continues in the target, use 
CTRL-Z to break emulation. 

NO BUS ACTIVITY Indicates no data strobe activity. Possible causes 

include the processor executing a STOP instruction 



BUS TIMEOUT WAITING 
FOR DTACK 
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PROCESSOR EXECUTING 
STOP INSTRUCTION 

TARGET BUS ERROR 
IS LOW 



TARGET HALT ASSERTED 



or, in a 68020 system, the processor is executing out 
of cache. 

This message indicates a status and does not 
necessarily indicate an error. 

For the 68000/08/10 processor only. See NO BUS 
ACTIVITY. 



Indicates that a bus error signal on the probe tip is 
held low by the target system. 

NOTE: This error requires a steady low from the 
target, whereas BUS ERROR and DOUBLE BUS 
FAULT both require the bus error pin to be negated. 

Indicates that the target reset has been asserted for 
longer than about .5 seconds. 
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Appendix C 

SERIAL DATA FORMATS 



In order to download a program into target memory, the ES 1800 needs some way to 
receive this data in an intelligible format. This Appendix describes the downloading 
formats which the ES 1800 understands. 
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MOS Technology Format 

Figure C-l. Specifications for MOS Technology Data Files Copyright 1983, 
Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



END-OF-FILE RECORD 



START CHARACTER 



BC = Byte Count. The hexadecimal number of data 
bytes in the record 



AAAA = Address of first data byte in record. AAAA 
in hexadecimal notation only 



HH = One data byte in hexadecimal notation 



START CHARACTER 

Byte Count. BC = 00 in End of File Record 
Record Count 

Checksum 



CCCC = Checksum. Two byte binary summation of 
preceding bytes in record (including address, and 
data bytes) in hexadecimal notation. 



This space can be used for line feed, carriage return or 
comments 



(Beginning of next record) 



LEGEND 

= Start Character 
BC - Byte Count (BO 00 in Record, BC = End of File Record] 
..AAAA- .- .Address Field 
CCCC = Checksum of Record 
RRRR = Record Count 
HH - Two Hexadecimal Digits (0:9, A:D) 



OUTPUT 



NOTES 



1) Number of bytes per record is variable. See Table 3.1 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 Hex Characters = 1 byte 



BCAAMHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAMHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAMHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAMAHHt^HHHr.HbbHHdHyyHajdHidtHtlHHHHHHCCC 
BCRRRRCCCC 



i7 
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Motorola Exorcisor Format 

Figure C-2. Specifications for Motorola Exorciser/16-BM Data Files/ 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



SIGN ON RECORD OPTIONAL 



START CHARACTERS 



BC = Byte Count. The number of data bytes plus 3 (1 for 
checksum and 2 for address) in hexadecimal notation 



AAAA - Address of first date byte in record. AAAA in 
hexadecimal notation only 



HH = One data byte in hexadecimal notation 



SO Start characters of sign on record Except 
for start characters SO record has same format as 
data record 



END OF FILE RECORD 



CC = Checksum. One's complement of binary summation 
of preceding bytes in record (including byte count, 
address and data bytes) in hexadecimal notation 

This space can be used for line feed, carriage return or 
comments 

(Beginning of next record) 



START CHARACTERS 

Byte Count. BC = 03 in End of File Record 
Address 



LEGEND 

50 = Optional Record Start Characters 

51 = Start Characters 
BC = Byte Count 

[(Date Butes/Record + 3] 
AAAA = Address of First Data Byte 
HH - Two Hexadecimal Digits (0-9, A-F) 
CC - Checksum of Record (one byte) 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3.1 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 

3) Sign on record may precede data 



2 Hex characters 1 byte 



Data Records 



)ras -» 



S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC / 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I / 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC Y 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I 
S1 BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC / 
S9BCAAAACC 
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Intel Intellec Format 

Figure C-3. Specifications for Intel Intellec/8/MDS Data Files/ 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



END OF FILE RECORD 



START CHARACTER 

BC = Byte Count. The hexadecimal number of data bytes 
in the record 



AAAA = Address of first date byte in record AAAA in 
hexadecimal notation only 



TT = Record Type (00) 

HH = One data byte in hexadecimal notation 



CC = Checksum. Negation (two's complement) of binary 
summation of preceding bytes in record (including byte 
count, address, and data bytes) in hexadecimal notation 

■ This space can be used for line feed, carriage return or 
comments 



START CHARACTER 

Byte Count. BC = 00 in End of File Record 
Address 

TT Record Type (01) 



LEGEND 

= Start Characters 

BC = Byte Count (Date Bytes/Record) 

AAAA = Address Field 

TT = Record Type 

H = One Hexadecimal Digit (0-9, A-F) 

CC = Checksum of Record 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 Hex characters 1 byte 



BGAAAATTHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 
BOVWATTHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC> 
BCAAAATTHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC J 
BCAA4ATT 



yds -m 
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Signetics/Absolute Object File Format 

Figure C-4. Specifications for Signetics/Absolute Object Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



END OF FILE RECORD 



START CHARACTER 



AAAA = Address of first date byte in record. AAAA in 
hexadecimal notation only 



BC - Byte Count. The hexadecimal number of data bytes 
in the record 

AC = Address Check. Every byte is exclusive O Red with 
the previous byte, then rotated left one bit. 



HH = One data byte in hexadecimal notation 



DC = Data Check. Every byte is exclusive O Red with the 
previous byte, then rotated left one bit. 

.This space can be used for line feed, carriage return or 
comments 



START CHARACTER 



Address 



Byte Count. BC - 00 in End of File Record 



.(Beginning of next record) 



LEGEND 

= Start Characters 
AAAA = Address Field 
BC - Byte Count (Date Bytes/Record) 

AC = Address Check. Checksum of address and byte count 

HH = Two Hexadecimal Digits (0-9, A-F) 

DC = Data Check. Checksum of data in record 



OUTPUT 



NOTES 



1 J Number of bytes per record is variable. See Table 3.1 . 
2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 HEX characters 1 byte 



7 



Data Records 



AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC i I 
AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC ' 
AAAABCAC 
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Tektronix Hexadecimal Format 

Figure C-5. Specifications for Tektronix Hexadecimal Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



/ = Start Character 



AAAA = Address of first date byte in record, 
(hexadecimal notation) 



BC = Byte Count. The hexadecimal number of data bytes 
in the record 

CC = Checksum. Eight bit sum of the four bit 
hexadecimal values of the six digits that make up the 
address and byte counts (hexadecimal notation) 



HH = One data byte in hexadecimal notation 



CC = Checksum. Eight bit sum modula 256, of the four 
bit hexadecimal values of the digits that make up the 
data bytes 

Carriage Return 

(Beginning of next record) 



OUTPUT 

NOTES 

1 ) Number of bytes per record is variable. See Table 3 1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 Hex characters 1 byte 



Data Records 



/AAMBCCCHHHHHHHHHHHHHKFrRHHHHHHHHHHHHHHHHCC I 
/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
'AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC J 
/AAAABCCC -^l^ 

E n d o f File R eco'd 
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ABORT RECORD 



// =Two Start Characters 

XX . X = Arbitrary string of ASCII characters 

Carriage Return 



END OF FILE RECORD 



START CHARACTER 



AAAA Transfer Address 



Byte Count. BC = 00 in End of File Record 

CC = Checksum. Eight bit sum of the four bit 
hexadecimal values of the six digits that make up 
the transfer address and the byte count 
(hexadecimal notation) 

Carriage return 



LEGEND 

= Start Characters 
AAAA = Address Field 
BC = Byte Count (Date Bytes/Record) 

CC - Checksum of Record 

HH = Two Hexadecimal Digits (0-9. A-F) 

X = Any ASCII Character 
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Extended Tekhex Format 

Copyright 1983, Tektronix; reprinted by permission 

Extended Tekhex uses three types of message blocks: 

1. The data block contains the object code. 

2. The symbol block that contains information about a program section and the 
symbols associated with it This information is only needed for symbolic 
debug. 

3. The termination block contains the transfer address and marks the end of the 
load module. 

NOTE 

Extended Tekhex has no specially defined abort block. To abort a 
formatted transfer, use a Standard Tekhex abort block. 

Each block begins with a six-character header field and ends with an end- of-line 
character sequence. A block can be up to 255 characters long, not counting the end- 
of-line character. The header field has the format shown in the following table. 
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ITEM 


NUMBER 
OF ASCII 
CHARACTERS 


DESCRIPTION 


% 


1 


A percent sign specifies that the block is 
in Extended Tekhex format. 


Block 
Length 


2 


The number of characters in the block: a 
two-digit hex number. This count does not 
include the leading % or the end-of-line. 


Block 
Type 


1 


6 = data block 
3 = symbol block 
8 = termination block 


Checksum 


2 


A two-digit hex number representing the 
sum, mod 256, of the values of all the 
characters in the block, except the leading 
%, the checksum digits, and the end-of-line. 
The following table gives the values for 
all characters that may appear in Extended 
Tekhex message blocks. 



Character Values for Checksum Computation 


CHARACTERS 


VALUES (DECIMAL) 


0..9 


0..9 


A.Z 


10..35 


$ 


36 


% 


37 


. (period) 


38 


_ (underscore) 


39 


a..z 


40-65 
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Variable-Length Fields 

In Extended Tekhex, certain fields may vary in length from 2 to 17 characters. This 
practice enables you to compress your data by eliminating leading zeros from 
numbers and trailing spaces from symbols. The first character of a variable-length 
field is a hexadecimal digit that indicates the length of the rest of the field. The digit 
0 indicates a length of 16 characters. 

For example, the symbols START, LOOP, and KLUDGESTARTSHERE are 
represented as 5START, 4LOOP, and OKLUDGESTARTSHERE. The values 0, 
100H, and FF0000H are represented as 10, 3100, and 6FF0000. 
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Data and Termination Blocks 

If you do not intend to transfer program symbols with your object code, you do not 
need symbol blocks. Your load module can consist of one or more data blocks 
followed by a termination block. The following table gives the format of a data 
block and a termination block. 



Extended Tekhex Data Block Format 


ITEM 


NUMBER 
OF ASCII 
CHARACTERS 


DESCRIPTION 


Header 


6 


Standard header field 
Block Type = 6 


Load Address 


2 to 17 


The address where the object code is to be 
loaded: a variable-length number. 


Object 


2n 


n bytes, each represented as two hex 
digits. 


Extended Tekhex Termination Block 


Header 


6 


Standard header field 
Block type = 8. 


Transfer 


2 to 17 


The address where program execution is to 
begin: a variable-length number. 



Symbol Blocks 

A symbol used in symbolic debug has the following attributes: 

1. The symbol itself: 1 to 16 letters, digits, dollar signs, periods, a percent sign, or 
symbolize a section name. Lower case letters are converted to upper case 
when they are placed in the symbol table. 

2. A value: up to 64 bits (16 hexadecimal digits). 

3. A type: address or scalar. (A scalar is any number that is not an address.) An 
address may be further classified as a code address (the address of an 
instruction) or a data address (the address of a data item). As symbolic debug 
does not currently use the code/data distinction, the address/scalar distinction 
is sufficient for standard applications of Extended Tekhex. 
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4. A global/local designation. This designation is of limited use in a load module, 
and is provided for future development If the global/local distinction is not 
important for your purposes, simply call all your symbols global. 

5. Section membership. A section may be thought of as a named area of memory. 
Each address in your program belongs to exactly one section. A scalar belongs 
to no section. 

The symbols in your program are conveyed in symbol blocks. Each symbol block 
contains the name of a section and a list of the symbols that belong to that section. 
(You may include scalars with any section you like.) More than one block may 
contain symbols for the same section. For each section, exactly one symbol block 
should contain a section definition field, which defines the starting address and length 
of the section. 

If you object code has been generated by an assembler or compiler that does not deal 
with sections, simply define one section called, for example, MEMORY, with a 
starting address of 0 and a length greater than the highest address used by your 
program; and put all your symbols in that section. 
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The following table gives the format of a symbol block. Tables that follow give the 
formats for section definition fields and symbol definition fields, which are parts of a 
symbol block. 



Extended Tekhex Symbol Block Format 


ITEM 


NUMBER 
OF ASCII 
CHARACTERS 


DESCRIPTION 


Header 


6 


Standard header field 
Block Type = 3 


Section Name 


2 to 17 


The name of the section that contains the 
symbols defined in this block: a 
variable-length symbol. 


Section 
Definition 


5 to 35 


This field must be present in exactly one 
symbol block for each section. This field 
may be preceded or followed by any number 
of symbol definition fields. The table on 
the next page gives the format for this 
field. 


Symbol 


5 to 35 


Zero or more symbol definition fields as 
described in the next table. 
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Extended Tekhex Symbol Block: Section Definition Field 


ITEM 


NUMBER 
OF ASCII 
CHARACTERS 


DESCRIPTION 


0 


1 


A zero signals a section definition field. 


Base 


2 to 17 


The starting address of the Address 
section: a variable-length number. 


Length 


2 to 17 


The length of the section: a variable-length 
number, computed as 1 + (high address base 
address). 




Extended Tekhex Symbol Block: Symbol Definition Field 


ITEM 


NUMBER 
OF ASCII 
CHARACTERS 


DESCRIPTION 


Type 


1 


A hex digit that indicates the global/local 
designation of the symbol, and the type of 
value the symbol represents: 

1 = global address 

2 = global scalar 

3 = global code address 

4 = global data address 

5 = local address 

6 = local scalar 

7 = local code address 

8 = local data address 


Symbol 


2 to 17 


A variable-length symbol. 


Value 


2 to 17 


The value associated with the symbol: a 
variable-length number. 
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The following figures show how the preceding tables of information might 
be encoded in Extended Tekhex. The information for the Extended Tekhex Symbol 
Block illustration could be encoded in a single 96-character block. It is divided into 
two blocks for purposes of illustration. 

Figure C-6. Extended Tekhex Data Block 



Block length: 15H = 21 



Checksum: 1CH = 28 = 1 +5+6+3+1 +0+0+0+2+0+2+... 




Object Code: 6 bytes 



%1561C3100020202020202 



rh r 1 ! r 



Load address: 100H 



Block type: 6 



Header character 



Figure C-7. Extended Tekhex Termination Block 




Block length: 8 



Checksum: 1AH = 26 = 0+8+8+2+8+0 



7 f 0881A280 




Transfer address: 80H 



' Block type: 8 



Header character 
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Figure C-8. Extended Tekhex Symbol Block 



Block length: 37H = 55 

Checksum: 60H = (3+7+3+8+28+31 +12+28+29+...)mod 256 



r 



Section definition field: 

base address = 40H; length = C6H 



%373608SVCSTUFF02402C622CRlD14OPEN25014READ25815WRITE260 

%373C88SVCSTUFF15CLOSE26814EXIT27029BUFLENGTH28013BUF278 
i . r , ' 



1_ 



Section name: 
Block type: 3 
Header character 



1 5CLOSE286 

-"LJ 



2 characters in 
symbol value "86" 



5 characters in symbol 
name "CLOSE" 



1 global address 



Motorola S-Record Format 



S-Record Content 

When viewed by the user, S-records are essentially character strings made of several 
fields which identify the record type, record length, memory address, code/data, and 
checksum. Each type of binary data is encoded as a 2-character hexadecimal 
number: the first character representing the high-order 4 bits, and the second the 
low-order 4 bits of the byte. 

The 5 fields which comprise an S-record are: type, length, address, code/data and 
checksum. 
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The fields are composed as follows: 



FIELD 


PRINTABLE 


CONTENTS 


CHARACTERS 


type 


2 


s-record type -- SO, SI, etc. 


record length 


2 


The count of the character pairs in the 
record, excluding the type and record length. 


address 


4, 6, or 8 


The 2-, 3-, or 4-byte address at or which the 
data field is to be loaded into memory. 


code/data 


0-2n 


From 0 to n bytes of executable code, memory- 
loadable data, or descriptive information. 
For compatibility with teletypewriters, some 
programs may limit the number of bytes to as 
few as 28 (56 printable characters in S- 
record). 


checksum 


2 


The least significant byte of the one's 
complement of the sum of the values 
represented by the pairs of characters making 
up the record length, address, and the 
code/data fields. 



Each record may be terminated with a CR/LF/NULL. Additionally, an S-record may 
have an initial field to accommodate other data such as line numbers generated by 
some time-sharing systems. 



Accuracy of transmission is ensured by the record length (byte count) and checksum 
fields. 
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S-Record Types 

Eight types of S-records have been defined to accommodate the several needs of the 
encoding, transportation, and decoding functions. The various Motorola upload, 
download, and other file-creating or debugging programs, utilize only those S- 
records which serve the purpose of the program. For specific information on which 
S-records are supported by a particular program, the user's manual for that program 
must be consulted. 

An S-record format module may contain S-records of the following types: 

50 The header record for each block of S-records. The code/data field may 
contain any descriptive information identifying the following block of 
SO-records. Under VERSAdos, the resident linker's EDENT command 
can be used to designate module name, version number, revision number, 
and description information which will make up the header record. The 
address field is normally zeros. 

51 A record containing code/data and the 2-byte address at which the 
code/data is to reside. 

52 A record containing code/data and the 3-byte address at which the 
code/data is to reside. 

53 A record containing code/data and the 4-byte address at which the 
code/data is to reside. 

S5 A record containing the number of SI, S2, and S3 records transmitted in a 
particular block. This count appears in the address field. There is no 
code/data field. 

57 A termination record for a block of S3 records. The address field may 
optionally contain the 3-byte address of the instruction to which control is 
to be passed. There is no code/data field. 

58 A termination record for a block of S2 records. The address field may 
optionally contain the 3-byte address of the instruction to which control is 
to be passed. There is no code/data field. 

59 A termination record for a block of SI records. The address field may 
optionally contain the 2-byte address of the instruction to which control is 
to be passed. Under VERSAdos, the resident linker's ENTRY command 
can be used to specify this address. If not specified, the first entry point 
specification encountered in the object module input will be used. There 
is no code/data field. 
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Only one termination record is used for each block of S-records. S7 and S8 records 
are usually used only when control is to be passed to a 3- or 4- byte address. 
Normally, only one header record is used, although it is possible for multiple header 
records to occur. 

Creation of S-Records 

S -record-format programs may be produced by several dump utilities, debuggers, 
VERSAdos' resident linkage editor, or several cross assemblers or cross linkers. ON 
EXORmacs, the Build Load Module (MBLM) utility allows an executable load 
module to be built from S-records; and has a counterpart utility in BUILDS, which 
allows an S-record file to be created from a load module. 

Several programs are available for downloading a file in S-record format from a host 
system to an 8-bit microprocessor-based or 16-bit microprocessor-based system. 
Programs are also available for uploading an S-record file to or from an EXORmacs 
system. 

Example: Shown below is a typical S-record-format module, as printed or displayed: 



S0060000484421B 

S1130000285F245F2212226A00042429000082337CA 

S113001000020000800082629001853812341001813 

S113002041E9000084E42234300182342000824A952 

S107003000144Ed492 

S9030000FC 



The module consist of one SO record, four SI records, and an S9 record. 
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The SO record is comprised of the following character pairs: 



so 


S-record type SO, indicating that it is a header record. 


0 6 


Hexadecimal 06 (decimal 6), indicating that six character pairs (OR 


ASCII 


bytes) follow. 


00 + 




00 


Four-character 2-byte address field, zeros in this example. 


48 
44 + 


ASCII H, D, and R - "HDR". 


52 




IB 


The checksum. 



The first SI record is explained as follows: 



SI S-record type Si, indicating that it is a code/data record to be 

loaded/verified at a 2-byte address. 

13 Hexadecimal 13 (decimal 19), indicating that 19 character pairs, 

representing 19 bytes of binary data, follow. 

00+ Four-character 2-byte address field; hexadecimal address 

00 0000, where the data which follows is to be loaded. 



The next 16 character pairs of the first SI record are the ASCII bytes of the actual 
program code/data In this assembly language example, the hexadecimal opcodes of 
the programs are written in sequence in the code/data fields of the SI records: 
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OPCODE 


INSTRUCT I 


ON 


285F 


MOVE.L 


(A7) + ,A4 


245F 


MOVE.L 


(A7) +,A2 


2212 


MOVE . L 


(A2) ,D1 


226A0004 


MOVE.L 


4 (A2) ,A1 


24290008 


MOVE.L 


FUNCTION (Al) ,D2 


237C 


MOVE.L 


#FORCEFUNC, FUNCTION (Al) 


o 


(The balance of this code is continued in the code/data 




fields of 


the remaining Si records, and stored in memory 




location 


0010, etc.) 


2A 


The checksum of the first SI record. 



The second and third SI records each also contain $13 (19) character pairs and are 
ended with checksums 13 and 52 respectively. The fourth SI record contains 07 
character pairs and has a checksum of 92. 



The S9 record is explained as follows: 



S9 


S-record type S9, indicating that it is a termination 


record . 


03 


Hexadecimal 03, indicating that three character pairs 


(3 bytes) follow. 


00 


The address field, zeros. 




FC 


The checksum of the S9 record. 





Each printable character in an S-record is encoded in hexadecimal (ASCII in this 
example) representation of the binary bits which are actually transmitted. 
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Intel Hex Format 

This format consists of symbol table information, data specifications for loading 
memory, a module starting address record (optional) and a terminator record. The 
format contains no information regarding the initial contents of any registers other 
than CS and IP: therefore, all other registers (in particular segment registers must be 
loaded explicidy by the programmer). 

The records in the file appear in this order: 
$$ 

symbol records - 0 ormore 
$$ 

data records and segment base address records - 0 or more, any 
order starting address record (optional) 
terminator record 



Symbol Record 

As many symbol records as needed may be contained in the object module. A 
variable number of symbols per line is generated, depending on the lengths of the 
symbols; records are packed as tight as may be. A module may contain no symbol 
recores. A sample record is shown below. 



APPLE 00000H LABEL 1 0D0C3H MEM OFFFFH ZEEK 01947H FIFTH 00005H 



Segment Base Address Record 

This record defines the segment base address relative to which the load addresses in 
subsequent data records are specified. The addres in this record is 16 bits, which are 
the upper bits of a 20-bit address; the lowest 4 bits are presumed to be zero. This 
segment base address has nothing to do with any of the Loader segment addresses, 
base addresses, load addresses, etc. Segment base addresses are generated internally 
by the Loader, are not under the user's control, and are generally of no concern to the 
user. The segment base address is presumed to be zero before any segment base 
address records are encountered. 
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12 3 4 5 6 7 8 9 10 11 12 13 14 15 
-.02000002 address checksum 



where: Column 1 contains indicating the start of a record. 

Column 2 and 3 contain "02", indicating there are 2 bytes of data in this record (the 
address). 

Columns 4,5,6 and 7 contain "0000". 

Columns 8 and 9 contain "02", identifying this record as a segment base address 
record. 

Columns 10, 11, 12 and 13 contain the segment base address. Column 10 is the most 
significant digit and column 13 is the least significant. 

Columns 14 and 15 contain a checksum, calculated as described below under Data 
Record. 



Data Record 

This record specifies data bytes that are to be loaded into memory. 



12 3 


4 5 6 7 8 9 


10 


11 . . 


41 


42 43 


byte 


load 0 0 


data 


data. 


.data 


checksum 


count 


address 


1 


2 


n 





where;. Column 1 contains ": " y indicating the start of a-record. 



Column 2 and 3 contain the count of the number of data bytes contained in this 
record. Column 2 is more significant. 

Columns 4,5,6 and 7 contain the address at which the first data byte is to be loaded. 
This address is a 16-bit offset from the current segment base addres (see segment base 
address record). Column 4 is most significant, and column 7 is least significant 

Columns 8 and 9 contain "00", identifying this record as a data record. 

Columns 10 through 41 (or fewer if not 16 data bytes) contain up to 16 bytes of data. 
Each byte occupies two columns, the leftmost being the more significant digit. The 
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leftmost byte is loaded into the address specified by columns 4 through 7 (plus the 
segment base address); subsequent bytes are loaded into subsequent (higher) 
addresses. 

The last two columns contain a checksum. This is the two's complement of the sum 
(modulo 256) of all bytes in the record (except the colon and the checksum itself). 



Starting Address Record 

This record specifies the starting execution address of the object module. It contains 
startup values for the CS and IP registers. 



1 2 


3 


4 


5 


6 


7 8 9 


10 11 12 13 


14 15 16 17 


18 19 


: 0 


4 


0 


0 


0 


0 0 3 


CS 


IP 


checksum 



where: Column 1 contains indicating the start of a record. 



Column 2 and 3 contain "04", indicating there are 2 bytes of data in this record (the 
CS and IP values). 

Columns 4,5,6 and 7 contain "0000". 

Columns 8 and 9 contain "03", identifying this record as a starting address record. 

Columns 10, 11, 12 and 13 contain the 16 bit value to be loaded into CS. 

Columns 14,15, 16 and 17 contain the 16 bit value to be loaded into IP. 

Columns 18 and 19 contain a checksum, calculated as described above under Data 
Record. 
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APPLICATION NOTES 



Applied Microsystems corporation offers a variety of applications notes on ES 1800 
emulators which explain in more detail how to use the emulator for specific purposes. 

If you would like copies of any of the Application Notes listed in this index, please 
contact your local Sales Office or representative, or the Applications department of 
Applied Microsystems Corporation. 

If you have ideas for additional application notes you would like to see, please let us 
know: 

Applications Department 

800-426-3925 (in Washington, 206-882-2000) 

or via electronic mail: 
{uw-beaver!tikal luunet I sun! fluke! tikal I decv ax! microsofkikal} Same! pubs-feedback 



Number 


Title 


Equipment 


ES-001 


Downloading and Uploading - to and from the Host Computer 


all ES 1800 


ES-002 


Two New Commands: COM, DIA 


ESI 800, ESL Version 2.3 
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INDEX 



-A- 

Absolute address, 5-88 
Absolute time, 7-31 
Absolute value, 4-14 
Acknowledge character, 5-3 
Address comparators, 7-4 
Address registers, 5-87 
Addressing 

68020, 5-56 
Alpha/numeric value, 4-7 
AND, 4-13, 7-10 
Assembler, 6-31 

directives, 6-35 

-B- 

Backspace, 4-27 

Base definition symbols, 4-10 

Base register, 4-9 

Bases 

default, 5-83 

input values, 5-83 
Baud rate, 3-13, 5-3,5-30 
Block data 

verify, 6-21 
Block move, 6-23 

verify, 6-26 
BNC connector, 3-5, 7-24 



Breaking emulation, 7-17, 7-60 
Breakpoints, 6-2, 7-17 
Bus cycles, 5-92 
Bus error registers 

68020, 5-72 
Bus speed, 5-23 
Bus time out enable, 5-13 
Byte mode, 4-26, 6-14 

-C- 

Cables, 3-6, 3-16 

Cache disable, 5-15 

CCR register, 5-75 

CCT.5-31 

Checksums, 5-39 

Clear memory map, 5-62 

Clear trace memory, 5-100 

Clear WHEN/THEN statements, 7-16 

Clock, 6-76 

Code space, 5-63 

Colon operator, 5-125 

Command entry mode, 6-3 

Commands 

abbreviating, 7-1 

command line, 4-6 

commonly used, 4-19, 4-20, 4-21, 4-22 

delay execution, 6-11 

ESL,4-6 
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exceptions, 4-6 

memory, 6-14 

mnemonics, 4-7 

port dependent, 5-31 

repeating, 5-89, 5-121, 5-124 

save keystrokes, 5-85, 5-87 

set-up, 5-1 

single character, 4-6 

terminator sequence, 5-3 
Communication with host, 5-31 
Communication with target programs, 5-46 
Comparator registers, 7-3 
Computer control, 1-6 
Computer port control, 5-39 
Configuration 

menus, 5-1 

system, 1-4 
Continuous address strobe, 5-14 
Control Boards, 3-2 
Control characters, 4-27 
Convert 

Time Stamp value, 5-136 
Copy data, 5-16 
Copy system variables, 5-28 
Count bus cycles, 7-21 
Count limit comparator, 7-9 
Count occurrences 

A to B, 7-55 

codeaeeess; 7-31 

memory access, 7-30 

memory and program activity, 7-55 

module linkage activity, 7-31, 7-55 

program flow activity, 7-55 

range, 7-55 
Counter overflow, 7-37 
Counter/timer use, 3-5, 7-24 
Counting events, 7-21 
CRT length, 5-3 
Ctrl Q, 4-28 
Ctrl R, 4-27 
Ctrl S, 4-28 



Ctrl X, 4-27 
Ctrl Z, 4-27 

Custom diagnostics, 6-48, 6-72 

Customer service, 2-6 

Cycle (68010), 6-12 

Cyclic redundancy check, 6-67, 6-77 

-D- 

Data, 7-4 

buffering, 5-30 

comparators, 7-4 

download, 5-38 

registers, 5-85 

requirements, 3-14 

serial data formats, C-l 

space, 5-63 

upload, 5-43 
DB-25 connectors, 5-30 
Default 

base, 5-83 

base register, 4-9 
Defining 

action lists, 7-12 

events, 7-10 
Delay command execution, 6-11 
Delete, 4-27 

Diagnostic functions, 6-47 

Diagnostics 

complete RAM test, looping, 6-55 
complete RAM test, single pass, 6-52 
CRC check of emulator, 6-67 
custom, 6-48, 6-68 
generate reset pulses, 6-66 
pass parameters, 6-73, 6-75 
read continuously from address, 6-57 
read data over entire range, 6-64 
simple RAM test, looping, 6-53 
simple RAM test, single test, 6-50 
write alternate patterns, 6-59 
write continuously to address, 6-58 
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write incrementing count, 6-65 

write pattern then read, 6-63 

write pattern then rotate, 6-61 
Disable bus errors on peeks/pokes, 5-17 
Disassemble 

trace memory, 5-101 

trace page, 5-115 
Disassembler, 6-38 
Display 

base, 5-83 

blank line, 5-135 

bus status, 6-78 

character string, 5-50 

event specifications, 7-14 

macros, 5-117 

memory block, 6-16 

raw trace bus cycles, 5-92 

revision dates, 5-134 

symbols, 5-127 
Don't care values, 4-9, 7-4 
Download 

corruption, 5-42 

custom diagnostics, 6-72 

errors, 5-40 

from computer port, 5-32 

from terminal port, 5-31 

hex format files, 3-13 

port control differences, 5-40 

procedures, 5-38 

symbols, 5-40 
Dyadic operator, 4-17 
Dynamic memory, 5-14, 5-24 

-E- 

EEPROM, 5-1, 5-2, 5-11, 5-26 
Elapsed time, 7-30 

A to B, 7-43, 7-44 

between module time, 7-30 

code access, 7-30 

in range, 7-43, 7-47 



in-module time, 7-30 

inter-module, 7-43 

memory access, 7-30 

memory time, 7-43 

out-of-module, 7-43 

program time, 7-43 

units, 7-41 
EMS control statements, 7-10 
Emulation, 5-91, 6-2 

breaking, 7-17 

halting, 6-3 

resetting, 6-3 

run mode, 6-2 

starting, 6-2 
Emulator set-up, 2-1 
END, 6-33 
Equation, 4-7 
Error messages, B-l 

data strobe messages, B-14 

ESL,B-1 

target hardware, B-10 
ES Driver control software, 1-6 
ES Language, 4-1, 4-2 
Esc, 4-27 

Escape sequence, 5-3 
ESL revisions, 7-33 
Event groups, 7-1 

changing, 7-27 
Event Monitor System, 4-12, 4-20, 4-22, 7-1 

address comparators, 7-4 

clear WHEN/THEN, 7-16 

comparator registers, 7-3 

count Events, 7-21 

Data and LS A comparators, 7-4 

define action list, 7-12 

display WHEN/THEN statements, 7-14 

event definition, 7-10 

event group change, 7-27 

registers, 5-69 

setup, 7-40 

special interrupts, 7-25 
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speed, 7-61 

status comparators, 7-5 

status mnemonics, 7-5 

trace events, 7-19 

trigger signal, 7-24 
Event, 7-10 
Examples, 7-43 

measuring elapsed time, 7-43 
Execute bus cycle, 6-12 
Executing custom diagnostics, 6-68 
Expression, 4-7 
Extend command lines, 4-6 
Extended Tekhex serial 
data records, 5-125 
External cycle start, 5-18 

-F- 

Fan filter, cleaning, 3-16 
Fast time out, 5-20 
Features, 7-30 
Files 

closing, 5-43, 5-44, 5-45 

collecting time stamp info, 7-42 

opening, 5-44 

viewing, 5-43 
Fill operator, 6-20 
Find memory pattern, 6-18 
Fuse, 3-5 

-G- 

General ES 1800 registers, 5-69 
General purpose 

address registers, 5-87 

data registers, 5-85 
Generate reset pulses, 6-66 
Groups, 4-12, 7-10, 7-27 



-H- 

Halting emulation, 6-3 
Hardcopy, 5-12, 5-16 
Help menu 

(68000/08/10), 4-19 

(68020), 4-21 
Help 

communications set-up, 4-18 
software switches, 4-18 
special diagnostic functions, 4-18 
Host computer, 1-6, 5-30, 5-31 

-I- 

ILG.5-56 

Illegal statement, 4-1 
Indirection operator, 4-8, 4-1 1 
Initializing ES 1800, 5-27 
Installation, 7-32 

hardware, 7-32 

software, 7-33 
Integer, 4-7 
Interrupt enable, 5-19 
Interrupt latency, 7-50 
Introspective mode, 5-21 

-L- 

Line assemble parameters, 6-33 
Line assembler, 4-25, 4-46, 6-31, 6-33 
Load 

overlay memory, 5-65, 6-28 

reset vectors, 6-8 

variables from EEPROM, 5-26 
Logic state 

analysis pod, 7-32 

analyzer (LSA), 1-11, 3-12 

probe, 7-4 
LSA comparators, 7-4 
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-M- 

Macros, 5-85, 5-87, 5-116 

clearing, 5-120 

define, execute, 5-118 

displaying, 5-117 

saving, 5-116 

truncation, 5-116 
Maintenance, 3-16 
Mapping the 68020, 5-56 
Measure elapsed time, 7-30 
Memory mode, 4-27 

assembler, 6-31 

block display, 6-16 

clear memory map, 5-62 

commands, 6-14 

disassembler, 4-26, 6-38 

display memory map, 5-53 

entering, 6-41 

exiting, 6-44 

fill with data, 6-20 

find data pattern, 6-18 

loading from target to overlay, 5-65 

mapping, 5-55 

modifying data, 6-40, 6-42 

pointer, 5-81, 6-46 

prompt, 4-25 

scrolling, 6-40, 6-45 

status register, 5-79 

trace, 5-90 

verify overlay, 5-66 

viewing, 6-40 

-N- 

NOT.4-13, 7-10 
Null modem cable, 2-3 
Null target, 3-10 
Numbers 
ESL,4-9 



-O- 

ON/OFFmenu, 5-1,5-10 
Operand cycle start, 5-18 
Operator precedence, 4-8, 4-14 
Operators 

ESL.4-8 

repeat, 5-121 
OR, 4-13, 7-10 

Oscilloscope use, 3-5, 6-47, 7-24 
Overflow 

counter, 7-37 
Overlay map, 5-56 
Overlay memory speed, 5-67 
Overlay memory, 1-9, 5-38, 5-52 

enable, 5-63 

load, 6-28 

verify, 6-29 

-P- 

Page through memory, 6-16 
Parentheses, 7-10 

ESL.4-7 

indirection, 4-12 

WHEN/THEN, 4-13 
Parity, 5-3 
Parts, 3-19 

Passing parameters to 

custom diagnostics, 6-69, 6-73 
Patching code, 7-25 
Pause mode, 1-7, 7-17 
Peek Poke trace, 5-22 
Peeking and Poking into 

target system (68000/68008), 6-71 
Peeking and Poking into 

target system (68010/68020), 6-69 
Peeks, 6-57 
Performance analysis 

collecting data, 7-42 
Peripheral equipment, 3-5 



ES 1800 Emulator User's Manual for 68000 Series Microprocessors 



Pin configurations. 3-13 
Pod, 3-6 
Pokes, 6-58 

Port control, 3-13, 5-16, 5-30 
computer, 5-36 

establish controlling port, 5-31 

terminal, 5-35 

transparent mode, 5-33 
Port dependent commands, 5-31 
Ports 

configuration, 5-30 

control considerations, 5-38 

controlling port, 5-36 

copying data to, 5-16 
Power supply, 3-1 
Power, 3-21 

Power-on sequence, 2-5 
Printing session, 5-12, 5-16 
Probe tip, 3-16 
Prompts, 4-25 
ESL.4-25 

-R- 

RAM test, looping 

complete, 6-52, 6-55 

simple, 6-50, 6-53 

testing, 6-47 
Range r 4-9 

ESL.4-9 
Raw trace bus cycles, 5-92 
Read data over range, 6-64 
Read target system clock, 6-76 
Readability, 5-135 
Real time, 1-8 
Rear Panel, 3-5 
Registers, 5-68 

68000/68008 target, 5-68 

68010 target, 5-68 

68020 target, 5-69 

address, 5-87, 7-4 



bus error, 5-70 
clearing, 5-74 
comparator, 7-2 
count, 7-21 
data, 5-79, 5-85 
display base, 5-69, 5-70, 5-77 
displaying, 5-74 
event monitor system, 5-69 
general emulator, 5-69 
general purpose address, 5-87 
general purpose data, 5-85 
general purpose, 5-1 16 
loading, 5-74 
Memory mode pointer 
MmP,6-40, 6-41 
modifying, 5-74 
overlay memory, 5-52 
reset status, 6-13 
saving, 5-70 
set/display base, 5-77 
types, 4-11 

using in run mode, 6-4 
Relative time, 7-31 

Repeat command line, 4-6, 4-27, 5-124 
Repeat operators, 5-121 
Reset, 6-13 
Reset 

button, 7-34 

cnaraeter, 5-3 

generate reset pulses, 6-66 

vectors, 6-2 
Revision dates, 5-134 
RO,5-55 

Run mode, 6-1,6-2, 7-1 

prompt, 4-25 

register use, 6-4 
Run program, 7-41 
Run target program, 6-5 
RW, 5-55 
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-S- 

S-records 

creation, C-16 

types, C-16 
Saved 

ON/OFfmenu, 5-1 

parameters, 5-9 

registers, 5-70 

Set menu, 5-1 

switches, 5-11 

variables, 5-26 
Scope loops, 6-47 
Searching 

trace memory, 5-90 
Sections, 5-125 

deleting, 5-131, 5-132 

display, 5-128 
Sequence numbers, 5-92 
Serial 

communications, 5-30 

data formats, C-l 

port set-up, 5-3 

ports, 3-5, 3-13 
Service, 2-6, 2-10 
SET, 5-1, 5-3, 5-55, 7-36 
Set-up 

commands, 5-1 

emulator, 2-1 

system, 1-4 

target system, 2-4 
Signing 

ESL,4-14 
Simulation tool, 3-10 
Single step, 5-121, 5-124 
Single- Argument Operators, 4-16 
Special characters, 4-27 
Special functions, 4-27, 6-49 
Special interrupts, 7-25 
Special modes, 4-26 
SR register, 5-75 



Stand-alone operation, 1-6 
Status 

comparators, 7-5 

mnemonics, 7-5 
Stop and step target system, 6-7 
Stop bits, 5-3 
Stopping emulation, 6-3 
Summary 

switch settings, 7-39 
Switches, 5-10 

bus time out enable, 5-13 

cache disable, 5-15 

continuous strobe, 5-14 

copy data to both ports, 5-16 

disable bus errors on peeks/pokes, 5-17 

ESL.7-36 

external cycle start, 5-18 

fast time out, 5-20 

interrupt enable, 5-19 

introspective mode, 5-21 

peek poke trace, 5-22 

positions, 7-38 

setting menu, 5-10 

tri-state address, 5-24 

view bus speed info, 5-23 
Symbolic references, 1-10, 4-9 
Symbols, 5-125 

define, 5-129 

deleting, 5-131, 5-132 

display, 5-127 

downloading, 5-40 

names, 5-88 

tables, 5-125 

uploading, 5-44 
System 

configuration, 1-4 

operation, 1-7 

setup, 1-4 

-T- 
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Target, 6-1 

commands, 6-1 
communication with, 5-46 
cyclic redundancy check, 6-77 
definition, 6-1 

display characters from memory, 5-50 

execute in bus cycles, 6-12 

loading into emulator, 6-28 

memory, 5-38 

read clock, 6-76 

run program, 6-5 

stop and step system, 6-7 

system peeks, 6-57 

system pokes, 6-58 

system set-up, 2-4 
TCT,5-31 
Temperature, 3-21 
Terminal control, 1-6 
Terminal port control, 5-39 
Test run of system, 2-6 
TGR 

choose input, 7-40 

Event Monitor System, 7-38 

external, 7-34, 7-38 
TGT,5-56 

Thumbwheel switch, 2-1, 3-2, 3-3 
Time base 

maximum, 7-31 

switch, 7-37 
Time period 

maximum, 7-37 
Time stamp module, 1-10 

label, 7-34 

reset button, 7-34 
Time units, 7-41 

reset button, 7-34 
Timestamping, 5-90 
Trace 

bus cycles, 7-19 

memory modes selection, 5-91 

subroutines, 7-27 



Trace memory, 1-8, 5-90 
clear trace memory, 5-100 
disassemble memory, 5-101 
disassemble page, 5-115 
display bus cycles, 5-92 
searching, 5-90 

Tracing events, 7-19 

Transparent mode, 4-27, 5-30, 5-33 
entering, 5-31 
exiting, 5-31 

Tri-state address, 5-24 

Trigger signal, 7-24 

Troubleshooting, 3-19 

-U- 

Unary operator, 4-14 
Units, 7-41 
Upload 

hex format files, 3-13 

serial data, 5-43 

symbols, 5-44 
User0,5-3 
Userl, 5-3 

- V- 

Vectors 

load reset, 6-8 
Verify 

block data, 6-21 

overlay memory, 5-66, 6-29 

serial data, 5-42 
View bus speed information, 5-23 
View time stamp information, 7-41 

- W- 

WHEN/THEN, 1-9, 7-1 
Word mode, 4-26, 6-14 
Write 
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data, 6-63 

incrementing count, 6-65 
patterns, 6-59, 6-61 

-X- 

X, 6-33 

XON/XOFF, 3-15, 5-3, 5-30, 5-43, 6-16 
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